An incident that highlights the growing risks in the AI was recently revealed on the Hugging Face. A malicious repository managed to enter trends , presenting itself as a legitimate OpenAI tool (Privacy Filter), with the aim of deceiving users and distributing information-sniffing software on Windows systems.
The repository appeared under the name Open-OSS/privacy-filter, copying the official OpenAI project almost verbatim and mimicking every element of its documentation. According to security researchers at HiddenLayer, the deception was so convincing that many users treated it as a trusted version.
OpenAI's "Privacy Filter" and its misleading use
OpenAI's actual Privacy Filter tool was introduced in April 2026 as a system for detecting and removing personally identifiable information (PII) from unstructured text. Its goal was to enhance privacy in applications that leverage AI models.
See also: Critical bug leaves Hugging Face's LeRobot exposed
However, the fake version of the repository had nothing to do with data security. Instead, it contained a loader.py, which triggered a malicious chain of command execution, leading to the download and execution of stealer malware on Windows computers.
Anatomy of the attack and technical operation
The attack was based on a multi-layered process. The user was asked to clone the repository and execute scripts such as start.bat for Windows or Python scripts for Linux and macOS.
The malicious script disabled SSL verification and used encoded URLs (Base64) to extract commands from external infrastructure. It then executed PowerShell commands that downloaded malware from a remote server.
To hide the activity, the JSON Keeper as a “dead drop” mechanism, allowing attackers to change payloads without modifying the original repository.
Extensive data interception capabilities
The final payload was designed as an advanced information stealer. It collects screenshots, data from applications like Discord, configuration files like FileZilla, as well as data from cryptocurrency wallets and browser extensions.
See also: Abuse of Hugging Face to distribute Android malware
Additionally, it targeted browsers based on engines such as Chromium and Gecko, collecting cookies, credentials, and session data.
Detection avoidance techniques
The malware incorporated anti-debugging and anti-sandboxing, checking whether it was running in a virtual environment. It also attempted to disable security mechanisms such as Microsoft Defender Antivirus and AMSI (Antimalware Scan Interface).
The researchers noted that the use of scheduled tasks was not intended to persist on the system, but to temporarily execute with SYSTEM privileges before deleting the trace itself.
Spread scale and false credibility
Before it was removed from the platform, the repository had amassed around 244,000 downloads and hundreds of likes in just a few hours, even reaching the top trends of Hugging Face. There are indications that these metrics may have been artificially boosted to create a sense of credibility and increase downloads.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The analysis revealed an additional six repositories with similar structure and loader scripts, suggesting an organized campaign:
- anthfu/Bonsai-8B-gguf
- anthfu/Qwen3.6-35B-A3B-APEX-GGUF
- anthfu/DeepSeek-V4-Pro
- anthfu/Qwopus-GLM-18B-Merged-GGUF
- anthfu/Qwen3.6-35B-A3B-Claude-4.6-Opus-Reasoning-Distilled-GGUF
- anthfu/supergemma4-26b-uncensored-gguf-v2
At the same time, a connection was detected with infrastructure related to the ValleyRAT, also known as Winos 4.0, which has been attributed to a threat group known as Silver Fox.
See also: Infected Python libraries in Hugging Face models
The new era of AI supply chain attacks
The incident highlights a critical reality: open source and AI ecosystems are becoming an increasingly attractive target for cybercriminals. Trusting popular platforms like Hugging Face is no longer enough without technical verification of the projects.
Experts warn that supply chain attacks, where malware is hidden inside seemingly legitimate tools, will increase significantly. This requires stricter control of repositories, code signing, and better education of users who leverage AI models and development tools.
This particular incident serves as a wake-up call for the entire industry: innovation in artificial intelligence must be accompanied by corresponding developments in cybersecurity.
