Malware disguised as Privacy Filter Shakes Hugging Face with 244 thousand downloads and reveals vulnerabilities in model distribution

A sophisticated campaign exploited confidence in Hugging Face's model repositories by uploading a piece of malware that posed as the legitimate OpenAI project called "Privacy Filter." The malicious repository became on the trend list and accumulated, according to public metrics, about 244,000 downloads before being removed, an incident that shows how model markets can become mass distribution vectors for malicious code.

The investigation was published by the company HiddenLayer, which detected the fraudulent collection on May 7. According to the technical analysis, the repository used typosquating techniques and copied official documentation to pass unnoticed; it actually included a loader.py file whose real function was to disable SSL checks, solve a URL encoded on base64 and run a remote payload through PowerShell that ended up installing an infostealer written in Rust nicknamed "sefirah." The infection chain included privilege climbing, modification of Microsoft Defender exclusions and exfiltration of data to a command and control server.

The reported malware had an attack profile oriented to the wide collection of secrets: credentials and cookies of Chromium and Gecko browsers, Discord tokens, cryptomoneda purse keys and extensions, SSH / FTP / VPN configuration files, purse seeds and multiple monitor screen catches. HiddenLayer also documented multiple anti-analysis techniques to avoid detection in virtual environments and sandboxes, which complicates the work of incident response teams.

There are legitimate doubts about the actual extent of the damage: many "like" and downloads may have been inflated by artificial automated or metric accounts, but that does not reduce the technical risk or the need to contain the threat. In addition, researchers detected reuse of the same cargo infrastructure between several repositories and a possible relationship to typosquating campaigns in npm, suggesting an organized operation targeting software supply chains.

The practical implications are clear: models and datasets exchange platforms are not immune to abuse; their open nature makes them attractive targets for malicious actors seeking distribution and anonymity. This requires strengthening hygiene at both platform and user level: validation of authors, automatic code scanning, signature of artifacts and stricter confidence controls for locally executed elements.

If you downloaded files from the affected repository or suspected you could run code from unverified sources, the most secure technical recommendation is strong: reimagine the equipment, break all the credentials and replace the coins and seed phrases of cryptomonedas. In addition, invalidate browser sessions and OAuth tokens, replace SSH / FTP keys, review exclusions on your antivirus and consider that tool cleaning does not always eliminate sophisticated back doors.

For users and equipment that have not been infected but work with external models, preventive measures should be applied: run models and scripts in isolated environments or virtual machines, review the source code and the load scripts before their execution, prefer models published by verified organizations and use known signatures or hashes to check integrity. From an operational point of view, it monitors suspicious outgoing connections and blocks C2-associated domains when appropriate.

The platforms also have outstanding tasks: to improve the automatic detection of malicious patterns in repository files, to strengthen content moderation processes, to provide verifiable metadata on authors and to provide rapid reports to the incident responders. Hugging Face and other suppliers must balance openness and security to reduce the attack surface without strangle research and collaboration.

If you want to read the technical report that detailed this campaign, HiddenLayer published his analysis here: HiddenLayer - Malware found in Hugging Face repository. To understand the platform's policies and controls, see the Hugging Face security page: Hugging Face - Security. These readings help contextualize why source verification and execution in controlled environments are not options, but essential practices.

In short, this incident is a reminder that the flexibility of IA ecosystems brings with it specific safety risks. Protecting itself requires working on two fronts: demanding structural improvements to platforms and adopting practical defenses in the developer and end-user environment.