Hugging Face Malicious Models Return: GPU Cryptojacking and NetSupport RAT Detection Guide

AI infrastructure is now a direct target. A cryptomining campaign abusing Hugging Face models has returned only days after being taken down, hijacking GPU servers and dropping an unauthorized access mechanism — with a single malicious model downloaded more than 28,000 times. Separately, a fake Solana starter kit on GitHub is engineered to trick AI coding agents into installing a NetSupport RAT on developer machines. If your organization runs GPU workloads, downloads community ML models, or lets AI coding assistants execute terminal commands autonomously, you are in scope for both campaigns. This post breaks down the attack chains and gives your SOC working detections and remediation steps.

Technical Analysis

Campaign 1: Malicious Hugging Face Models — GPU Cryptojacking

The most important detail in this story is the resilience of the operation. The campaign was previously identified and the offending models were removed from Hugging Face — and the operators re-uploaded and resumed distribution within days. That tells defenders two things: takedown is not a durable control, and the economics of the campaign (free GPU compute at scale) justify rapid reconstitution for the attacker.

The attack chain follows the now-familiar malicious-model pattern:

Distribution: Weaponized models are published to Hugging Face under plausible names, accumulating organic downloads — 28,000+ in this case — because the platform is trusted by default in ML pipelines.
Execution: Malicious code rides the model artifact itself. Python-based model formats (notably Pickle-serialized artifacts) execute arbitrary code at load time — before any inference happens. Simply instantiating the model with torch.load() or a vulnerable deserialization path runs the payload. The model may also function normally, masking the infection.
Payload: A cryptominer is deployed that consumes GPU capacity — the exact resource these servers exist to provide, making them ideal targets. Mining traffic typically egresses over Stratum protocol (stratum+tcp://) to pool infrastructure on ports such as 3333, 4444, 5555, or 7777.
Persistence / access: The reporting indicates an unauthorized access mechanism was planted alongside the miner — consistent with a reverse shell or backdoor account — meaning the intrusion is not limited to resource theft. Treat every affected host as fully compromised, not merely 'infected with a miner.'

Affected platforms: Any environment that pulls and loads community models — GPU clusters, cloud ML instances (AWS/Azure/GCP), on-prem inference servers, data-science workstations, and CI pipelines that download models at build or test time. No CVE is associated with this campaign; this is abuse of legitimate platform functionality, not a software vulnerability, which is precisely why patching cannot fix it.

Campaign 2: Fake Solana Starter Kit — NetSupport RAT via AI Coding Agents

The second campaign is a glimpse of where social engineering is heading: the target is not the human developer — it is the developer's AI coding agent. A GitHub repository masquerades as a legitimate Solana starter kit. Its documentation and setup instructions are crafted so that when an AI coding assistant (Claude Code, Cursor, Copilot-style agents with shell access) processes the repository, the agent follows the embedded instructions and executes an installation step that deploys NetSupport Manager — a legitimate remote administration tool abused as a RAT.

Key mechanics defenders must understand:

Instruction smuggling: Malicious directives live in README files, setup scripts, or dependency manifests. An agent operating with terminal permissions executes them faithfully because they look like ordinary onboarding steps (npm install, a postinstall script, a curl-piped installer).
Living-off-the-land RAT: NetSupport is signed, legitimate commercial software. It will not trip signature-based AV. Its client component (client32.exe), configuration files (client32.ini), and default listening behavior (TCP 5405) are your detection anchors.
Blast radius: Developer workstations hold cloud credentials, SSH keys, signing keys, and source code. A RAT on a developer endpoint is a supply-chain precursor, not an endpoint problem.

Exploitation status: Both campaigns are confirmed active in the wild with real-world distribution (28,000+ model downloads is confirmed exposure, not theoretical). Neither appears in CISA KEV as of writing — KEV tracks vulnerabilities, and these are technique campaigns.

Detection & Response

The detections below target the observable behaviors: mining protocol egress, miner process artifacts, deserialization-time code execution, and NetSupport RAT installation. Tune allowlists for any legitimate remote-admin tooling before deployment.

YAML

---
title: Cryptominer Process Execution or Stratum Pool Connection on GPU Hosts
id: 4f2c8a91-6b3d-4e5a-9c17-2d8f1a3b5e60
status: experimental
description: Detects execution of common cryptomining binaries or command lines referencing Stratum mining pool protocol, consistent with the Hugging Face malicious model campaign hijacking GPU servers.
references:
  - https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1496
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\xmrig.exe'
      - '\xmr-stak.exe'
      - '\cgminer.exe'
      - '\bfgminer.exe'
      - '\ethminer.exe'
      - '\t-rex.exe'
      - '\nbminer.exe'
  selection_cli:
    CommandLine|contains:
      - 'stratum+tcp://'
      - 'stratum+ssl://'
      - '--donate-level'
      - '--coin='
      - '--algo=rx/'
  condition: 1 of selection_*
falsepositives:
  - Sanctioned mining or GPU benchmarking environments (rare; allowlist explicitly)
level: high
---
title: Python ML Framework Loading Model Spawning Child Process
id: 8e1b7c42-3d5f-4a6b-b2c9-7f4e0a1d8c35
status: experimental
description: Detects Python processes loading machine learning models that subsequently spawn shells, downloaders, or scripting engines - a hallmark of malicious Pickle-based model deserialization such as the Hugging Face cryptomining campaign.
references:
  - https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\conda.exe'
      - '\jupyter.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\wget.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  filter_known:
    CommandLine|contains:
      - 'pip install'
      - 'conda install'
  condition: selection_parent and selection_child and not filter_known
falsepositives:
  - ML pipelines that legitimately shell out for data preprocessing; tune per environment
level: high
---
title: NetSupport RAT Client Installation or Execution
id: 2a9d4f18-7c6e-4b1a-8d53-9e0c2b7f4a16
status: experimental
description: Detects execution or installation of the NetSupport remote administration client (client32.exe), abused as a RAT by the fake Solana starter kit campaign targeting AI coding agents.
references:
  - https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\client32.exe'
      - '\pcicfgst.exe'
      - '\NSM.exe'
  selection_path:
    Image|contains:
      - '\NetSupport\'
      - '\AppData\Local\Temp\client32'
  condition: 1 of selection_*
falsepositives:
  - Environments with licensed, sanctioned NetSupport deployments - verify inventory before enabling
level: high

KQL — Microsoft Sentinel / Defender

// Hunt: cryptomining behavior and NetSupport RAT across Windows and Linux (via Syslog/CEF)
// Part 1: Miner processes, Stratum pool indicators, and GPU-abuse command lines (Windows)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName has_any ("xmrig", "xmr-stak", "cgminer", "bfgminer", "ethminer", "t-rex", "nbminer")
   or ProcessCommandLine has_any ("stratum+tcp://", "stratum+ssl://", "--donate-level", "--algo=rx/")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc;

// Part 2: Python/ML processes spawning shells or downloaders (malicious model deserialization)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName in~ ("python.exe", "python3.exe", "conda.exe", "jupyter.exe", "python")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "curl.exe", "wget.exe", "certutil.exe", "wscript.exe", "bash", "sh", "curl", "wget")
| where ProcessCommandLine !has_any ("pip install", "conda install")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName;

// Part 3: NetSupport RAT artifacts and egress to mining-pool ports (network layer)
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (3333, 4444, 5555, 7777, 14444) and RemoteUrl !endswith ".microsoft.com"
   or InitiatingProcessFileName has_any ("client32.exe", "pcicfgst.exe")
   or RemotePort == 5405
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| order by TimeGenerated desc;

// Part 4: Linux GPU hosts via Syslog ingestion - miner and stratum strings in process exec
Syslog
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any ("xmrig", "stratum+tcp", "stratum+ssl", "donate-level", "nbminer", "t-rex")
| project TimeGenerated, Computer, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc

VQL — Velociraptor

-- Velociraptor hunt artifact: HuggingFaceMinerAndRAT
-- Surfaces cryptominer processes, NetSupport RAT clients, and suspicious
-- outbound connections to mining-pool ports across the fleet.

LET miner_procs = SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(xmrig|xmr-stak|cgminer|bfgminer|ethminer|t-rex|nbminer|client32|pcicfgst)'
   OR CommandLine =~ '(?i)(stratum\+(tcp|ssl)://|donate-level|algo=rx/)'

LET miner_conns = SELECT Pid, Name, Raddr, Rport, Status
FROM netstat()
WHERE Rport in (3333, 4444, 5555, 7777, 14444, 5405)
  AND Status =~ 'ESTABLISHED'

LET netsupport_files = SELECT FullPath, Size, Mtime
FROM glob(globs=[
  'C:/Program Files*/NetSupport/**/client32.*',
  'C:/Users/*/AppData/**/client32.*',
  'C:/Users/*/AppData/Local/Temp/**/client32.*'
])

SELECT 'miner_process' AS Finding, format(format='%v', args=miner_procs) AS Detail FROM miner_procs
UNION ALL
SELECT 'mining_or_ratom_connection' AS Finding, format(format='%v', args=miner_conns) AS Detail FROM miner_conns
UNION ALL
SELECT 'netsupport_artifact' AS Finding, format(format='%v', args=netsupport_files) AS Detail FROM netsupport_files

Triage and containment script

Use this on suspected GPU hosts (Linux) to confirm miner presence and sever access, and on developer workstations (Windows/PowerShell) to hunt NetSupport RAT artifacts. Run read-only checks first; the removal actions are commented for deliberate execution.

Bash / Shell

#!/usr/bin/env bash
# Security Arsenal - GPU cryptojacking triage (Linux ML/GPU hosts)
# Run as root. Review output before uncommenting containment actions.

echo "=== [1] Miner processes and Stratum indicators ==="
ps auxww | grep -Ei 'xmrig|xmr-stak|cgminer|bfgminer|ethminer|t-rex|nbminer|stratum\+' | grep -v grep

echo "=== [2] Established connections to common mining ports ==="
ss -tnp | grep -E ':(3333|4444|5555|7777|14444)\b'

echo "=== [3] GPU utilization anomalies (unexplained 100% load) ==="
command -v nvidia-smi >/dev/null && nvidia-smi --query-compute-apps=pid,process_name,used_memory --format=csv

echo "=== [4] Persistence: cron, systemd units, shell profiles modified recently ==="
crontab -l 2>/dev/null; ls -lt /etc/cron.d/ /etc/systemd/system/ 2>/dev/null | head -30
grep -rEi 'curl|wget|stratum|base64 -d' /etc/cron.d/ /var/spool/cron/ 2>/dev/null

echo "=== [5] Recently modified Python caches / model dirs (deserialization droppers) ==="
find /home /root /opt /tmp -name '*.py' -o -name '*.pkl' -o -name '*.pt' -o -name '*.bin' 2>/dev/null \
  | xargs ls -lt 2>/dev/null | head -20

echo "=== [6] Unauthorized access mechanism: new users, SSH keys, listening shells ==="
awk -F: '$3 >= 1000 || $3 == 0 {print $1}' /etc/passwd
find /home /root -name authorized_keys -mtime -14 2>/dev/null
ss -tlnp | grep -Ev ':(22|80|443|53)\b'

# --- CONTAINMENT (uncomment only after review) ---
# pkill -9 -f 'xmrig|stratum\+'                    # kill miner processes
# iptables -A OUTPUT -p tcp -m multiport --dports 3333,4444,5555,7777,14444 -j DROP
# systemctl isolate rescue.target                  # last-resort isolation

PowerShell

# Security Arsenal - NetSupport RAT triage (developer workstations)
# Read-only hunt; removal actions commented at the bottom.

Write-Host '=== [1] NetSupport processes and services ==='
Get-Process | Where-Object { $_.Name -match 'client32|pcicfgst|^NSM' } |
  Select-Object Name, Id, Path, StartTime
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'NetSupport|client32' } |
  Select-Object Name, State, PathName, StartMode

Write-Host '=== [2] NetSupport file artifacts (incl. Temp/AppData drops) ==='
Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)','C:\Users' -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match '^client32\.(exe|ini)$' -or $_.DirectoryName -match 'NetSupport' } |
  Select-Object FullName, LastWriteTime

Write-Host '=== [3] Network connections on NetSupport default port 5405 ==='
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -eq 5405 -or $_.LocalPort -eq 5405 } |
  Select-Object LocalAddress, RemoteAddress, RemotePort, OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name}}

Write-Host '=== [4] Persistence: Run keys and scheduled tasks referencing NetSupport ==='
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
  Out-String | Select-String -Pattern 'client32|NetSupport'
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'client32|NetSupport' } |
  Select-Object TaskName, TaskPath, State

# --- CONTAINMENT (uncomment after verification) ---
# Get-Process client32 -ErrorAction SilentlyContinue | Stop-Process -Force
# Remove-NetFirewallRule -DisplayName '*NetSupport*' -ErrorAction SilentlyContinue
# New-NetFirewallRule -DisplayName 'Block NetSupport 5405' -Direction Outbound -Protocol TCP -RemotePort 5405 -Action Block

Remediation

There is no patch for either campaign — these are technique-level abuses of trusted platforms and tooling. Remediation is architectural and procedural.

If a host loaded a malicious Hugging Face model:

Rebuild, don't clean. A backdoor mechanism was planted alongside the miner. Miner removal is cosmetic; reimage affected GPU hosts from known-good media and rotate every credential, API key, and SSH key that touched the host — including Hugging Face tokens and cloud instance credentials.
Audit scope by download provenance. Query your artifact/registry logs and CI pipelines for downloads of the flagged models. 28,000+ downloads means cluster-wide exposure is plausible if models are shared via internal model registries or base images. Check container images and AMIs for embedded model files.
Hunt for the persistence mechanism using the triage script above (new local accounts, recently modified authorized_keys, unexpected listeners) before declaring containment.

Structural defenses for ML model supply chain:

Mandate Safetensors over Pickle. Enforce the safetensors format in your model-loading code and set TRANSFORMERS_OFFLINE/proxy controls where feasible. Hugging Face already flags models whose Pickle files contain suspicious imports — treat any such warning as a hard block in CI.
Scan before load. Integrate Pickle-scanning (e.g., picklescan, modelscan) into your model ingestion pipeline so every third-party model is statically inspected before it reaches a GPU host.
Egress control on GPU VLANs. ML training/inference segments have no business initiating outbound connections to arbitrary IPs on ports 3333/4444/5555/7777. Default-deny egress with explicit allowlists for Hugging Face, package registries, and model hubs.
GPU utilization alerting. Baseline expected GPU load per workload; alert on sustained compute from processes outside your scheduling framework (Kubernetes, Slurm).

Defenses for the AI-agent RAT lure:

Constrain agent autonomy. AI coding agents must not execute install, postinstall, or curl-piped shell commands from unvetted repositories without human approval. Disable autonomous shell execution or run agents in sandboxed, ephemeral containers with no credential access.
Block NetSupport where unlicensed. If your organization does not use NetSupport, block client32.exe and outbound TCP 5405 via AppLocker/WDAC and firewall policy — signed-but-unauthorized remote admin tools are a top-tier RAT vector.
Treat repo instructions as untrusted input. README files and setup scripts are prompt-injection surfaces for agents. Vet repositories before pointing an agent at them, exactly as you would vet an npm package.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub