MicrosoftSystem64 Malware Abuses Hugging Face for Stealthy Data Theft

Gbhackers •Mayura Kathir • May 29, 2026

A sophisticated supply chain attack targeting the npm ecosystem has been uncovered, involving a malicious package named js-logger-pack that evolved into a powerful cross-platform malware loader. First observed in early April 2026, the package went through 29 incremental versions, gradually transforming from a seemingly benign logging utility into a full-scale information stealer and remote access Trojan. Despite […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MicrosoftSystem64 Malware Exploits Hugging Face for Data Theft A sophisticated malware named MicrosoftSystem64 has been identified, leveraging Hugging Face datasets for data exfiltration. This malware, which masquerades as a legitimate Microsoft process, has been active since early April 2026 and has undergone 29 version updates, evolving from a benign logging tool into a potent information stealer and remote access Trojan. The attack primarily targets the npm ecosystem, affecting numerous developers and organizations that utilize these packages. The malware's stealthy operation makes it difficult for security tools to detect, raising concerns about its potential widespread impact. Current mitigation efforts are ongoing, but specific details on remediation are limited. Security professionals are advised to monitor their systems for unusual activities related to npm packages. 3 sources 65

Extracted Entities

MicrosoftSystem64 Malware Abuses Hugging Face for Stealthy Data Theft

The full story

Extracted Entities

Attack Types (3)

Malware (2)

MITRE ATT&CK (1)

Tools (2)