Affected Systems

Hugging Face users running self-hosted inference servers (Xinference, GPUStack) with trust_remote_code enabled. AI coding agents and developers searching for Solana starter kits on GitHub. 31 malicious Hugging Face repositories across 7 accounts; flagship model downloaded 28,412 times. Fake GitHub repository (SolanaUpdateTools/solana-starter-kit) live since November 2025 with 286 stars.

Exploitation Status

Active exploitation confirmed. Hugging Face campaign resurfaced within days of initial takedown in September 2026. Attacker wallet received approximately $5,000 in cryptocurrency. Nine machines from a shared research GPU cluster observed mining simultaneously. GitHub repository delivering NetSupport RAT payload still live at time of reporting.

Business Impact

Organizations running self-hosted AI inference servers face GPU hijacking for crypto mining, backdoor installation via reverse shells, and potential container escape leading to host compromise. The trust_remote_code feature executes arbitrary Python before model loading, bypassing standard malware scans. AI coding agents may autonomously install NetSupport RAT when querying GitHub for Solana development resources, granting persistent remote access without developer awareness. Killing miner processes does not remove backdoors. Hugging Face's scanning tools (Protect AI, JFrog) flagged payload as non-ML but did not prevent 28K+ downloads.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all Hugging Face models loaded with trust_remote_code=True since September 2026; cross-reference against IOCs in Pluto Security report and check for processes mimicking Linux system names or connections to Alibaba Cloud C2 servers
  • Treat any system that loaded MENXIANGYU/qwen2-tiny, htt0118/qwen2-tiny, or related models as fully compromised; perform forensic imaging, rotate all credentials accessible from the host, and rebuild from known-good backups
  • Block trust_remote_code by default in Xinference and GPUStack deployments; require manual approval and code review before enabling for any model
  • Monitor GitHub repositories referenced by AI coding agents; block SolanaUpdateTools/solana-starter-kit and scan for NetSupport Manager connections to maxwintodaybtc[.]com and developer-update[.]app domains
  • Search endpoints for NetSupport Manager installations with non-standard configurations; check Windows startup locations and scheduled tasks for persistence mechanisms tied to the fake Solana kit payload