---
title: Hunt: fake "qwen2-tiny" models on Hugging Face run a miner and reverse shell the moment they load with trust_remote_code; 31 repos, 32,000+ downloads, back within days of takedown | ctxsec
url: https://ctxsec.com/items/hunt-pluto-load-mine-hugging-face-trust-remote-code-miner
description: ""
status: "researcher report (Pluto Security, Oct 29); live model independently checked by BleepingComputer; download counts are not confirmed infections"
published: 2026-10-29
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-pluto-load-mine-hugging-face-trust-remote-code-miner.md)

researcher report (Pluto Security, Oct 29); live model independently checked by BleepingComputer; download counts are not confirmed infections

2026-10-29

### Hunt: fake "qwen2-tiny" models on Hugging Face run a miner and reverse shell the moment they load with trust_remote_code; 31 repos, 32,000+ downloads, back within days of takedown

Pluto Security tracked 31 malicious repositories across seven Hugging Face accounts (plus a ModelScope mirror) posing as small Qwen2 test checkpoints. The weights are empty: the flagship `MENXIANGYU/qwen2-tiny` has a 42-byte `model.safetensors`. The payload is a Python file named in `auto_map` (for example `modeling_evil2.py`) that runs at import time when a caller sets `trust_remote_code=True`, before any model loads. It targets GPU hosts running **Xinference** and **GPUStack**, rented GPU boxes, shared notebooks and CI jobs.

- **Behavior:** installs a miner disguised as a kernel worker, a watchdog that restarts it, removes rival miners, and in later builds opens reverse shells and adds SSH/cron persistence; one script can escape a container to the host. Status is reported back through fake Xinference model names.
- **Takedown didn't stop it:** after the first wave was removed, a second wave of 19 repos appeared within days and was still live eight days after Pluto reported it. BleepingComputer confirmed a copy uploaded Oct 25 by `htt0118` was still live with the same miner and reverse shell. The flagship scanned clean on the Hub's scanners.
- **Attribution (researchers' assessment):** a financially motivated, Chinese-speaking operator.

**Hunt:** look for `/tmp/.cch/`, unexpected `svc.py` processes, a process named `[kworker/u20:1]` with mining arguments, and Xinference registrations named `qwen2-tiny-` or `ezv-` followed by encoded text. Search model caches (`~/.cache/huggingface`) for repos from the accounts in Pluto's IOC table. If a host loaded one of these models, treat it as compromised even if GPU use looks normal: preserve evidence, remove cron/SSH/shell-startup persistence, rebuild if in doubt, and rotate every credential the process could reach.

Sources: [Pluto Security: Hugging Face malware campaign "Load/Mine" (Oct 29)](https://pluto.security/blog/hugging-face-malware-campaign-load-mine/) · [BleepingComputer: Hugging Face malware campaign returns to hijack GPUs for crypto mining (Oct 29)](https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/)