← Back to feed
2026-06-03 Supply ChainMalicious ToolModel Poisoning TLP:CLEAR

Hugging Face and ClawHub Compromised: 352,000+ Malicious Models and AI Agent Skills Deliver Backdoors, Cryptominers, and Credential Stealers Across Open AI Ecosystem

Date: 2026-06-03
Tags: supply-chain, malicious-tool, model-poisoning

Executive Summary

Hugging Face and ClawHub, the two largest repositories for AI models and agent skills, have been systematically compromised with hundreds of malicious entries that steal credentials, open backdoors, and hijack AI agents for cryptocurrency mining. Hugging Face hosts more than a million machine learning models used by virtually every AI company on the planet and has been found to contain hundreds of malicious models capable of executing arbitrary code; ClawHub has been infiltrated by 341 malicious skills designed to steal credentials, open reverse shells, and hijack AI agents for cryptocurrency mining. Protect AI, which partnered with Hugging Face to scan the platform's model library, examined more than four million models and identified approximately 352,000 unsafe or suspicious issues across 51,700 models.

Campaign Summary

FieldDetail
Campaign / MalwareClawHub/Hugging Face Supply Chain Poisoning Campaign
AttributionUnknown; linked to threat actors 'hightower6eu' and 'sakaen736jih' (Medium Confidence) (confidence: medium)
TargetAI developers, enterprises deploying open-source models, OpenClaw/AI agent users
VectorMalicious model uploads (Pickle deserialization RCE), trojanized agent skills, credential stealers, cryptominers
Statusactive
First Observed2026-04/05 (widespread, but Protect AI partnership assessment in May 2026)

Detailed Findings

575+ malicious skills were identified across 13 developer accounts, targeting both Windows and macOS with payloads including trojans, cryptominers, and AMOS stealer; the campaign targeted both Windows and macOS systems, indicating a deliberate cross-platform approach; two threat actors operating under the alias 'hightower6eu' with 334 malicious skills and 'sakaen736jih' with 199 malicious skills uploaded were identified. Trojanized skills masquerade as legitimate tools but instruct users to execute encoded commands or install hidden malicious dependencies; indirect prompt injection was observed where hidden instructions cause AI agents to execute malicious actions on behalf of users. The attack technique, known as 'nullifAI,' exploits Python's pickle serialisation format by embedding malicious Python code at the start of the pickle byte stream and compressing the file using 7z rather than the default ZIP format.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195Malicious models and skills injected into Hugging Face and ClawHub
Arbitrary Code ExecutionT1059Pickle deserialization RCE via malicious model loading
Credential AccessT1110AMOS stealer and credential harvesting from AI agent execution
Resource HijackingT1496Cryptominers embedded in agent skills
ExecutionT1204User-initiated model download and agent skill installation

IOCs

Domains

_Specific IOCs not published; Protect AI and JFrog scanning tools used for detection_

Full URL Paths

_Specific IOCs not published; Protect AI and JFrog scanning tools used for detection_

Splunk Format

_No IOCs available for Splunk query_

Package Indicators

hightower6eu malicious skills (334 uploads)
sakaen736jih malicious skills (199 uploads)
Hugging Face malicious models (100+ identified by JFrog)

Detection Recommendations

Mandate SafeTensors format as the only accepted model serialization (avoid Pickle); implement model signature verification and checksumming on all downloaded artifacts; scan all Hugging Face and ClawHub repositories for malicious skill patterns (reverse shell construction, credential harvesting, cryptocurrency mining libraries); monitor for unusual dependencies in agent skill install scripts; implement endpoint detection for Pickle deserialization attempts from untrusted sources; use Protect AI or similar ML supply chain scanners in the development pipeline; monitor for AMOS stealer IoCs and cryptominer signatures post-deployment.

References