The detail that lingers from Pluto Security‘s research is a number that kept rising. Pluto Security disclosed the second wave on October 20, the malicious repositories stayed up, and five days later the flagship fake model stood at 18,012 downloads and was still live.
A download counter that kept climbing
The arithmetic tells the story. The campaign’s most popular payload, MENXIANGYU/qwen2-tiny, stood at 7,354 downloads on October 20. Within hours it reached 9,584, and by October 25 the Hub listed it at 18,012, a gain of more than 10,600 since October 20. That one repository is roughly 97% of the 18,544 second-wave downloads. Across both waves and the linked models, the campaign totals 21,614.
An operator that changed methods
The first wave had already been removed. Both Hugging Face accounts and the ModelScope mirror came down, and within days a second wave appeared under four new accounts. A header comment in its payload references “report §9.1” and states that “ammunition must be self-hosted.” The second wave replaced the first wave’s hardcoded SSH key with reverse shells, and Pluto Security describes the change as the operator adapting to the takedown.
Proof the victims were real
These were not downloads into empty space. While Pluto Security analyzed the first-wave payout wallet, nine workers joined within 90 seconds of each other with names that read like a shared notebook cluster, one of them an A100 Multi-Instance GPU partition. They stopped submitting shares about six minutes later, which fits an administrator killing the jobs. The wallet itself had received about 2,276 PRL, roughly $5,000, across 716 transactions and was still active on October 21, after its repositories were removed.
The cost of the gap
While repositories stay up, more people can download them, and each infection can plant access that outlives the miner. Pluto Security found SSH keys, cron persistence, shell-startup hooks, a watchdog and reverse shells, and notes that killing the miner or deleting the model does not remove them. The access these payloads plant does not expire when the miner stops, so each affected machine needs to be checked and cleaned.
The findings behind the numbers, briefly
Underneath the timeline is a coherent operation. Since September 2026, a financially motivated, Chinese-speaking operator or small group, in Pluto Security’s assessment, has disguised cryptocurrency miners and backdoors as small Qwen2 models on the Hugging Face Hub. Delivery runs through a model-loading feature that executes repository code, and Pluto Security found nothing that analyzes what that code does: the flagship scanned clean and none of the 12 first-wave repositories was flagged. The campaign spans 28 repositories across six Hugging Face accounts and a ModelScope mirror, and the wave-two binary unpacks to peakminer.
What the standoff asks of defenders
Pluto Security’s guidance puts the work on the people who load models. Review the .py files an auto_map points to before setting the flag, pin the reviewed revision, and run untrusted code with limited privileges, restricted network access and no production secrets. For anyone affected, isolate the machines, preserve evidence, remove every route back in and replace exposed credentials from a clean machine. A static check at upload time for subprocess, socket, ctypes or raw-IP network calls in files referenced by auto_map would have caught the payloads earlier still.
The number that stays
A flagship model at 7,354 downloads on the day of disclosure and 18,012 five days later is the picture Pluto Security’s data leaves. The repositories were still live on October 25.
