Malware Found In Trending Hugging Face Repository Open Oss Privacy Filter

On the 7th of May 2026, we identified malicious code in the Hugging Face repository Open-OSS/privacy-filter , which at the time appeared among the platform's top trending repositories with over 200k downloads until its removal by the Hugging Face team. The repository had typosquatted OpenAI's legitimate Privacy Filter release, copied its model card nearly verbatim, and shipped a loader.py file that fetches and executes infostealer malware on Windows machines.

If you cloned Open-OSS/privacy-filter (or any of the Hugging Face repos listed in the IOCs table below) and executed start.bat , python loader.py , or any file from the repository on a Windows host, treat the system as fully compromised and prioritise reimaging over cleanup. Because the payload is a credential-harvesting infostealer, do not log into anything from the affected host before wiping it. Once the host is isolated, rotate every credential that was stored in browsers, password managers, or credential stores on that machine, including saved passwords, session cookies, OAuth tokens, SSH keys, FTP credentials (FileZilla in particular), and any cloud provider tokens. Treat browser sessions as compromised even if the password was not saved, since session cookies may have been exfiltrated and can bypass MFA. Move any cryptocurrency wallet funds to a new wallet generated on a clean device, and assume seed phrases, keystores, and wallet extension data may have been stolen. Invalidate Discord sessions and reset Discord passwords, since tokens and master keys are explicitly targeted. On the network side, block the IOCs in the table below at your egress, and hunt historically for connections to identify any other affected hosts.

The attack chain appears to unfold over six stages.

The user lands on huggingface[.]co/Open-OSS/privacy-filter . The model card is copied near-verbatim from OpenAI's legitimate Privacy Filter, including the link to OpenAI's real model card PDF. The README diverges from the legitimate project in one place: it instructs users to clone the repo and run start.bat (Windows) or python loader.py (Linux/macOS) directly.

The loader.py script first runs decoy code (a DummyModel class, with fake training output, and a synthetic dataset) to look like a real loader. It then calls a function named _verify_checksum_integrity() , which:

Using jsonkeeper[.]com (a public JSON paste service) as the C2 channel lets the attacker rotate the payload without modifying the repository.

The fetched command runs via:

with creationflags=0x08000000 ( CREATE_NO_WINDOW ). Execution is fully silent. This stage is Windows-only; on Linux and macOS, the call fails and is swallowed.

The JSON paste returns a PowerShell one-liner that downloads update.bat from https[://]api.eth-fastscan[.]org/update.bat to %TEMP%\update.bat and launches it via cmd.exe /k.

The eth-fastscan[.]org domain mimics a blockchain analytics API. The use of cmd.exe /k (which keeps the window open) rather than /c is unusual and leaves a cmd.exe process with update.bat in its command line as an indicator on compromised hosts.

The batch file has varied slightly over time, but generally performs six main actions:

Despite using a scheduled task, this stage establishes no persistence : the task is destroyed before any reboot. It is being used as a one-shot SYSTEM-context launcher.

The final payload is a 1.07 MB (1,125,478 bytes) Rust-based executable with the following capabilities:

Anti-analysis. It hides its use of Windows APIs to defeat static analysis, runs checks to detect debuggers and sandboxes, looks for signs it's running in a virtual machine (VirtualBox, VMware, QEMU, Xen), and attempts to disable Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) to evade behavioural detection.

Collector modules. Eight parallel collectors target distinct data sources:

Exfiltration. Collected data is packaged into a JSON payload and uploaded via WinHTTP using a POST request with a Bearer authorization header.

During sandbox execution , the malware was observed transmitting exfiltrated data to recargapopular[.]com. The example below has been sanitized to remove payload values while preserving the original schema.

Notable strings from the binary include:

Before access to Open-OSS/privacy-filter was disabled, the repository reached the #1 trending position on Hugging Face with approximately 244K downloads and 667 likes in under 18 hours, numbers that were almost certainly artificially inflated to make the repository appear legitimate.

Of the 667 accounts that liked the repository, the vast majority followed predictable, auto-generated naming patterns:

A subset of these suspected inauthentic engagement accounts also appeared as followers of anthfu .

Through HiddenLayer's Hugging Face telemetry, we identified six repositories under that account, all uploaded on April 24, 2026, containing another malicious loader.py ( 6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c ) file. The loader contained nearly identical functionality and used the same command-retrieval URL ( jsonkeeper[.]com/b/AVNNE ) as observed in the Open-OSS/privacy-filter repository.

Observed repositories included:

On April 26, 2026, the api[.]eth-fastscan[.]org domain was observed serving a separate sample ( c1b59cc25bdc1fe3f3ce8eda06d002dda7cb02dea8c29877b68d04cd089363c7 ) that beacons to welovechinatown[.]info , a C2 documented in Panther's research into an npm typosquat delivering the WinOS 4.0 implant. The shared infrastructure suggests these campaigns are possibly linked and likely part of a broader supply chain operation targeting open-source ecosystems.

Last Updated: 08 May 2026, 04:14 PT ‍

This blog explores how tampering with a model’s tokenizer can fundamentally alter AI behavior without modifying model weights or architecture.

Malware Found in Trending Hugging Face Repository "Open-OSS/privacy-filter"

On May 7th, 2025, we identified malicious code in the Hugging Face repository Open-OSS/privacy-filter, which is currently among the platform's top trending repositories, with over 200k downloads in the past day.

AI Agents in Production: Security Lessons from Recent Incidents

Get research-driven insights, emerging threat analysis, and practical guidance on securing AI systems—delivered to your inbox.