# Malicious Hugging Face repositories return with GPU miners and backdoors

_Published Thursday, October 29, 2026 at 6:20 PM EDT · Security, AI · Latest · Tier 2 — Notable_

A malware campaign using Hugging Face repositories returned within days of takedowns, targeting GPU servers with cryptocurrency miners and backdoors, researchers at Pluto Security found. They identified 31 malicious repositories across seven accounts; linked models had more than 32,000 downloads, which do not establish confirmed infections.

The campaign abuses trust_remote_code, an option that runs Python supplied with a model when it loads. Some versions open a reverse shell, giving attackers direct server access. Hugging Face disabled the flagship model, but BleepingComputer confirmed that a near-identical copy still available contained the same miner and reverse shell.

## Sources

- [BleepingComputer](https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/)

---
Canonical: https://techandbusiness.org/newswire/i6CLg9YP6EFC2HmZQdS65y
Published: 2026-10-29T22:20:13.870Z
Story chronology: 2026-10-29T22:09:24.000Z
Retrieved: 2026-10-30T00:31:27.125Z
Publisher: Tech & Business (techandbusiness.org)