← Back to feed
2026-06-12 Supply ChainMalware TLP:CLEAR

Fake OpenAI Privacy Filter Malware Campaign Reaches 244K Downloads on Hugging Face Before Removal

Date: 2026-06-12
Tags: supply-chain, malware

Executive Summary

A fraudulent AI model posing as an OpenAI release briefly became one of the most downloaded projects on Hugging Face before researchers determined it was distributing credential-stealing malware to Windows systems. Before its removal, the repository accumulated roughly 244,000 downloads and hundreds of positive ratings in less than a day, reaching the top of Hugging Face's trending rankings. Some of the infrastructure tied to the attack overlaps with activity previously associated with ValleyRAT, a remote access trojan linked by researchers to the China-aligned threat group known as Silver Fox.

Campaign Summary

FieldDetail
Campaign / MalwareFake OpenAI Privacy Filter Campaign
AttributionSuspected China-aligned (Silver Fox connection via infrastructure) (confidence: medium)
TargetDevelopers downloading AI models from Hugging Face
VectorMalicious Hugging Face repository with typosquatting/impersonation
Statusactive
First Observed2026-05-07

Detailed Findings

The repository, named Open-OSS/privacy-filter, impersonated OpenAI's legitimate Privacy Filter release, copied its model card almost word-for-word, and included a malicious loader.py file that fetched and executed credential-stealing malware on Windows hosts. The loader.py script first executes decoy code that resembles a legitimate AI model loader before launching a concealed infection chain. The script disabled SSL verification, decoded a base64-encoded URL linked to the public JSON hosting service jsonkeeper.com, retrieved a remote payload instruction, and passed commands to PowerShell. HiddenLayer identified six additional Hugging Face repositories uploaded under a separate account that used nearly identical loader logic and shared infrastructure with the campaign.

MITRE ATT&CK Mapping

TechniqueIDContext
Supply Chain CompromiseT1195Malicious AI model repository uploaded to public platform
Credential AccessT1110Infostealer malware payload harvests system credentials
ExecutionT1059.003PowerShell commands executed by malicious loader

IOCs

Domains

jsonkeeper.com

Full URL Paths

https://github.com/Open-OSS/privacy-filter

Splunk Format

"jsonkeeper.com" OR "https://github.com/Open-OSS/privacy-filter"

Package Indicators

Open-OSS/privacy-filter

Detection Recommendations

Monitor Hugging Face repository uploads for model cards that closely mimic legitimate vendor releases; implement code signature analysis on Python loader files in downloaded models; track C2 infrastructure patterns (jsonkeeper.com and similar dynamic C2 hosts); deploy endpoint detection on PowerShell execution from model loading workflows; validate model integrity via cryptographic signing before importing.

References