Hugging Face Impersonates Privacy Filter, Malware
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Hugging Face repository “Open-OSS/privacy-filter” copied OpenAI’s privacy‑filter description verbatim, reached #1 trending with ~244,000 downloads and 667 likes in 18 hours before being disabled.
- OpenAI released the legitimate “privacy-filter” model in April 2026 to detect and redact PII in unstructured text, which the malicious repo impersonated.
- HiddenLayer analysis revealed the repo’s loader.py executed a Rust‑based info‑stealer that disables SSL verification, decodes a Base64 URL from JSON Keeper, runs PowerShell to fetch a second‑stage payload from api.eth‑fastscan.org, and exfiltrates data to recargapopular.com.
- HiddenLayer also identified six additional “anthfu” repositories using the same Python loader, indicating a broader supply‑chain campaign.
- ValleyRAT was previously delivered via a malicious npm package “trevlo” that used a post‑install hook to run obfuscated JavaScript, fetch PowerShell, and download the Winos 4.0 stager binary, linking the current infrastructure to the Chinese‑linked “Silver Fox” group.
- Silver Fox is the hacking group attributed to the ValleyRAT campaign, suggesting the current Hugging Face attacks share infrastructure with earlier C2 servers (welovechinatown.info).
Why it matters: The attackers harvested personal data from thousands of users, while the incident erodes trust in open‑source model repositories, forcing developers and platforms like Hugging Face to tighten vetting and users to verify sources before downloading, and prompting security teams to monitor supply‑chain threats more aggressively.
