OpenAI released an open-source model called Privacy Filter in late April—a lightweight tool that automatically detects and masks personally identifiable information (PII) in text, published on Hugging Face under Apache 2.0. It quickly drew developer attention. But that buzz also attracted copycats.
Security firm HiddenLayer disclosed that a fake account named "Open-OSS" uploaded a nearly identical repository on Hugging Face, also named privacy-filter, with a model card copied verbatim from the official version. The only difference lurked in the readme—it instructed users to download and run start.bat (Windows) or loader.py (Linux/Mac).
Top of the Charts in 18 Hours, 98% of Likes from Bots
The fake repository hit #1 on Hugging Face's trending list in just 18 hours, racking up about 244,000 downloads and 667 likes. HiddenLayer traced 657 of those likes to accounts matching automated bot naming patterns—over 98% of social signals were fake. Download counts were likely inflated the same way, creating a false appearance of popularity to lure real developers.
Six-Stage Attack Chain: From Fake Training Screens to System-Level Theft
The malware's design is sophisticated. When loader.py runs, it first displays a fake model training output—progress bars, synthetic datasets, dummy class names—making it look like a real AI loader. But in the background, it quietly disables security checks, pulls an encoded command from a public JSON paste site, and passes it to a hidden PowerShell instance.
That command downloads a second script from a domain posing as a blockchain analysis API (api.eth-fastscan.org), which then fetches the actual payload—a custom infostealer written in Rust. It adds itself to the Windows Defender exclusion list, gains SYSTEM privileges via a scheduled task, and that task self-deletes immediately after execution, leaving almost no trace.
Targeting Chrome/Firefox, Discord, Crypto Wallets
This infostealer leaves no stone unturned. It grabs all stored data from Chrome and Firefox—passwords, login session cookies, browsing history, encryption keys. It goes after Discord accounts, cryptocurrency wallet seed phrases, SSH keys, and FTP credentials. It also takes screenshots on all displays. Finally, it bundles everything into a compressed JSON blob and sends it to an attacker-controlled server.
Even more cunning, the malware checks if it's running inside a virtual machine or security sandbox; if so, it quietly exits. Its design is single-shot: hit real targets, steal everything, then vanish.
Not an Isolated Incident: At Least Seven Malicious Repositories Found
HiddenLayer notes this isn't a one-off. Under the same command server, they found another Hugging Face account named "anthfu" hosting six more repositories using the identical malicious loader, uploaded in late April. The impersonated models include Qwen3, DeepSeek, and Bonsai, all targeting AI developers.
The attackers didn't hack OpenAI or Hugging Face itself. Instead, they published convincing knock-offs, used bots to boost rankings, and waited for developers to download and execute. This same playbook was used in the 2024 LottiePlayer JavaScript library supply-chain attack, which cost one user 10 BTC (then worth over $700,000).
The fake repository has since been taken down by Hugging Face, but as of writing, the platform hasn't announced any new review mechanism for trending repositories. Seven malicious repositories are known—how many remain undiscovered or have been self-deleted is still unknown.
What If You Downloaded It?
Security experts advise: if you cloned Open-OSS/privacy-filter on a Windows machine and ran any file from it, treat that device as fully compromised. Don't log into any service from that computer until it's cleaned. Change all credentials stored in browsers, generate a new wallet on a clean device, and transfer crypto assets immediately. Force-invalidate Discord sessions and reset passwords. SSH keys and FTP credentials should also be considered exposed.