Fake OpenAI Repository on Hugging Face Pushes Infostealer Malware

Why It Matters

The attack exposes a supply‑chain weakness in AI model sharing platforms, where trusted‑looking repositories can deliver credential‑stealing malware to thousands of users. It underscores the urgent need for stronger vetting and monitoring on services that host executable code for developers.

Key Takeaways

• Malicious repo hit #1 on Hugging Face, 244k downloads.
• Loader script fetched PowerShell payload that installed Rust infostealer.
• Malware stole browsers, crypto wallets, Discord tokens, VPN credentials.
• Attack added itself to Microsoft Defender exclusions to avoid detection.
• HiddenLayer linked campaign to npm typosquatting distributing WinOS 4.0.

Pulse Analysis

The recent Hugging Face incident illustrates how threat actors can weaponize the credibility of popular AI repositories. By mimicking OpenAI’s Privacy Filter project, the malicious repo leveraged the platform’s trending algorithm to attract unsuspecting developers. Its loader script silently bypassed SSL checks, decoded a hidden URL, and executed a PowerShell chain that ultimately deployed a Rust‑based infostealer. This malware harvested a wide array of sensitive data—from browser cookies and passwords to cryptocurrency wallet seeds—before exfiltrating it to a remote command‑and‑control server.

Beyond this single campaign, the episode highlights systemic challenges facing AI model marketplaces. These platforms blend open‑source collaboration with executable code, creating a fertile ground for supply‑chain attacks. Prior incidents have shown that malicious actors can embed harmful payloads in model files, datasets, or auxiliary scripts, often evading detection until they achieve significant reach. The sheer volume of downloads—potentially inflated—demonstrates how quickly malicious code can proliferate when trust signals are spoofed. As AI adoption accelerates, vendors must invest in automated scanning, provenance verification, and community reporting mechanisms to safeguard the ecosystem.

For enterprises and individual users, the fallout calls for immediate remediation and longer‑term hardening. Re‑imaging compromised machines, rotating credentials, and invalidating browser sessions are essential first steps. Organizations should also enforce strict policies on third‑party model usage, incorporating sandbox testing and endpoint protection that monitors for unusual privilege escalation or Defender exclusion modifications. Continuous threat intelligence monitoring for emerging AI‑related malware will be critical as attackers increasingly target the tools that power modern development pipelines.