Hugging Face now has malicious fake repositories stealing cryptocurrency wallets and account credentials

Techub News message, according to Decrypt, malicious repositories impersonating OpenAI recently appeared on the Hugging Face platform, receiving 244,000 downloads within 18 hours and topping the trending chart. The attacker spread a six-stage information stealer through executable files, stealing browser passwords, Discord tokens, cryptocurrency wallet keys, and SSH credentials.

According to reports, the malware executed silently in the background via PowerShell, packaging and sending the data to the attacker's server. Security company HiddenLayer found that 657 likes on the repository came from bot accounts, and the download count may have been artificially manipulated. The repository has now been removed, but it has already caused a large-scale risk of user credential leakage.