Crypto-mining campaign hijacks Hugging Face GPUs, deploys malware

• A crypto-mining campaign targeting Hugging Face models has returned, hijacking GPU servers and installing backdoors.
• One model involved in the campaign was downloaded over 28,000 times.
• The campaign exploits a feature of the model-loading library, not an exploit, to run Python that infects a machine.
• A separate incident involves a fake Solana starter kit on GitHub designed to trick AI coding agents into installing a NetSupport RAT.
• Pluto Security detailed how the trust_remote_code download turns into malware.