Pluto Security tracked 31 malicious repositories across seven Hugging Face accounts (plus a ModelScope mirror) posing as small Qwen2 test checkpoints. The weights are empty: the flagship MENXIANGYU/qwen2-tiny has a 42-byte model.safetensors. The payload is a Python file named in auto_map (for example modeling_evil2.py) that runs at import time when a caller sets trust_remote_code=True, before any model loads. It targets GPU hosts running Xinference and GPUStack, rented GPU boxes, shared notebooks and CI jobs.

• Behavior: installs a miner disguised as a kernel worker, a watchdog that restarts it, removes rival miners, and in later builds opens reverse shells and adds SSH/cron persistence; one script can escape a container to the host. Status is reported back through fake Xinference model names.
• Takedown didn't stop it: after the first wave was removed, a second wave of 19 repos appeared within days and was still live eight days after Pluto reported it. BleepingComputer confirmed a copy uploaded Oct 25 by htt0118 was still live with the same miner and reverse shell. The flagship scanned clean on the Hub's scanners.
• Attribution (researchers' assessment): a financially motivated, Chinese-speaking operator.

Hunt: look for /tmp/.cch/, unexpected svc.py processes, a process named [kworker/u20:1] with mining arguments, and Xinference registrations named qwen2-tiny- or ezv- followed by encoded text. Search model caches (~/.cache/huggingface) for repos from the accounts in Pluto's IOC table. If a host loaded one of these models, treat it as compromised even if GPU use looks normal: preserve evidence, remove cron/SSH/shell-startup persistence, rebuild if in doubt, and rotate every credential the process could reach.