A financially motivated operator or small group has been using the Hugging Face Hub since September 2026 to distribute cryptocurrency miners and backdoors disguised as small Qwen2 language models, according to a report shared by Pluto Security . The campaign has run through two waves and more than 40 code iterations across 28 repositories. Its second wave remained live as of October 25, five days after Pluto Security reported it. Downloads across the campaign and its linked models had passed 21,000 by that date.

Pluto Security reported the first wave to Hugging Face and ModelScope. Both Hugging Face accounts behind that wave and a ModelScope mirror were taken down. Within days, a second wave appeared under four new accounts, with revised loaders and reverse shells in place of the first wave's hardcoded SSH key.…