Fake Qwen2 model repos on Hugging Face hid PRL mining malware
Security & Exploits ·
Thirty-one Hugging Face repositories impersonating small Qwen2 models secretly installed PRL cryptocurrency miners and, in some versions, backdoors, accumulating more than 32,000 downloads before parts of the campaign were taken down.
According to a post detailing the operation, the malicious payload activated only when users loaded the models with the trust_remote_code option enabled, a common setting for running custom model code locally, as described in the report. Once triggered, the code quietly installed a PRL miner disguised as a legitimate system process, and some repository versions reportedly included backdoor functionality allowing remote control of the infected machine.
The first batch of malicious repositories was removed from Hugging Face, but according to the same account, new accounts re-uploaded similar repositories within days, keeping the download count climbing past the 32,000 mark. Wallets tied to the attackers had already received roughly 2,276 PRL from the first wave, valued at around $5,000 at the time of the post, with mining proceeds reportedly continuing to accrue even after the original repositories were taken down.
A reply to the original post underscored the risk in plainer terms, noting that users trying to save money by running models locally ended up lending their GPUs to someone else's mining operation, and that enabling trust_remote_code carried a cost higher than the model weights themselves.
The incident is corroborated elsewhere in the cluster, with a separate account describing the same pattern of fake Qwen2 repositories deploying Pearl miners against users who loaded the compromised files. The advice circulating alongside the warnings centers on basic hygiene: avoid enabling trust_remote_code for models from unverified sources, check running processes if GPU usage spikes unexpectedly, and keep mining hardware separate from machines used for AI workloads.
Unresolved at this point is the full scale of the campaign beyond the 31 identified repositories, the total number of new accounts used to re-upload the malware after takedowns, and whether Hugging Face has implemented broader screening to catch similar impersonation attempts before they accumulate downloads. It also remains unclear how many of the 32,000-plus downloads resulted in active infections versus incomplete installs.