Hugging Face malware lured users with fake OpenAI model
malicious hugging face repository impersonated openai's privacy filter, delivering infostealer malware to windows machines via a compromised loader.py file before its removal.
attackers uploaded a repository to hugging face named 'open-oss/privacy-filter' that closely copied openai's legitimate model card but included a malicious loader.py file designed to execute powershell commands on windows hosts. hiddenlayer found that the script disabled ssl verification, fetched a remote payload from jsonkeeper.com, and installed a rust-based infostealer targeting discord, cryptocurrency wallets, and browser credentials. the repository artificially inflated its popularity to reach the platform's trending list, and six other repositories with identical infrastructure were identified. this incident highlights the risk of public ai registries serving as vectors for supply chain infiltration, as traditional software composition analysis tools fail to detect malicious logic within ai model setup scripts.