MicrosoftSystem64 Malware Exploits Hugging Face for Data Theft

A sophisticated malware named MicrosoftSystem64 has been identified, leveraging Hugging Face datasets for data exfiltration. This malware, which masquerades as a legitimate Microsoft process, has been active since early April 2026 and has undergone 29 version updates, evolving from a benign logging tool into a potent information stealer and remote access Trojan. The attack primarily targets the npm ecosystem, affecting numerous developers and organizations that utilize these packages. The malware's stealthy operation makes it difficult for security tools to detect, raising concerns about its potential widespread impact. Current mitigation efforts are ongoing, but specific details on remediation are limited. Security professionals are advised to monitor their systems for unusual activities related to npm packages.

Key Points: • MicrosoftSystem64 malware disguises itself as a legitimate Microsoft process. • The malware exploits Hugging Face datasets for stealthy data exfiltration. • 29 versions of the malware have been released since early April 2026.