Most threat research describes a thing that happened. The more useful kind describes how an adversary behaves, because behavior shows what to expect next. Pluto Security‘s research on a cryptominer campaign hiding in fake Qwen2 models on the Hugging Face Hub shows an operator that changed its methods after a takedown while leaving its entry point untouched.
The strategic fact
After Pluto Security reported the first wave, both Hugging Face accounts and the ModelScope mirror were taken down. A second wave followed within days: 16 repositories across four new accounts, with revised loaders, more aggressive and more varied payloads, and reverse shells in place of the first wave’s hardcoded SSH key. Pluto Security describes the change as the operator adapting to the takedown. The flagship kept climbing, from 7,354 downloads on October 20 to 18,012 on October 25, and stayed live five days after the repositories were reported.
What changed, and what did not
Access changed. The planted SSH key, one grep away from detection, gave way to reconnecting reverse shells in three builds. Delivery changed in places too: one later dropper restricts its second stage at :8898/lf_py.py by source IP, and other requests get a 403 and the text “static ip.” so an analyst fetching the same URL can miss the payload served to an allowed host.
The foundation did not change. The final first-wave build already combined memory-backed execution, process disguise, competing-miner removal and Xinference reporting, and the second-wave mining builds kept it. Repository-hosted binaries and mirrors continued from wave one, and the entry point stayed the same: a plain Python file imported through auto_map. Pluto Security notes that the operator could replace listings and change access methods without changing the entry point.
Why file-level fixes lag
A takedown removes specific repositories. It does not change the conditions that let them work. Hugging Face runs every file through antivirus and partner scanners inspect weight formats, but nothing analyzes what the Python does. None of the 12 first-wave repositories was flagged, and the second-wave flagship scanned clean while it collected 18,012 downloads. The wave-one production build also used clean names, Qwen2Config and modeling_qwen2.py.
Controls that outlast the next repository name
Pluto Security’s guidance does not depend on knowing which repositories are bad. Review the .py files an auto_map points to before the flag is set, which would have caught every payload in this campaign. Pin the reviewed revision. Run untrusted code with limited privileges, restricted network access and no production secrets. Require authentication on the Xinference API and limit its reachability. A static check at upload time for subprocess, socket, ctypes or raw-IP network calls in files referenced by auto_map would have caught the payloads earlier still. Pluto Security’s summary is to treat model code like any other software dependency: review it, pin it and isolate its runtime.
The posture problem for AI infrastructure
The payloads were written for GPU hosts running self-hosted inference, especially Xinference, along with rented GPU machines, shared research notebooks and CI jobs that pull small test models without anyone reading the code. Pluto Security notes that such machines tend to hold credentials, data and network access worth far more than the compute, and that the access these payloads plant does not expire when the miner stops.
The findings underneath, kept brief
Pluto Security’s assessment is a financially motivated, Chinese-speaking operator or small group. Since September 2026, the campaign has disguised fileless cryptocurrency miners and backdoors as small Qwen2 models and delivered them through a model-loading feature that runs repository code. The miner hides itself and removes rival miners, while persistence through SSH keys, cron, shell hooks and reverse shells outlasts the miner. The campaign spans 28 repositories and six Hugging Face accounts plus a ModelScope mirror, 21,614 downloads with linked models, and a first-wave payout wallet that has received about 2,276 PRL, roughly $5,000.
The long view
The second wave was still live at the time of Pluto Security’s data. The entry point was the same in both waves. Pluto Security says it expects more campaigns like this one and is tracking them closely.
