{"id":867,"date":"2026-05-11T09:00:27","date_gmt":"2026-05-11T09:00:27","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=867"},"modified":"2026-05-11T09:00:27","modified_gmt":"2026-05-11T09:00:27","slug":"fake-openai-privacy-filter-repo-hits-1-on-hugging-face-draws-244k-downloads","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=867","title":{"rendered":"Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 11, 2026<\/span><\/span>Supply Chain Attack \/ Threat Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A malicious Hugging Face repository managed to take a spot in the platform’s trending list by impersonating OpenAI’s Privacy Filter open-weight model to deliver a Rust-based information stealer to Windows users.<\/p>\n

The project, named Open-OSS\/privacy-filter<\/a>, masqueraded as its legitimate counterpart, released by OpenAI late last month (openai\/privacy-filter<\/a>), including copying the entire description verbatim to trick unsuspecting users into downloading it.Access to the malicious model has since been disabled by Hugging Face.<\/p>\n

Privacy Filter was unveiled<\/a> in April 2026 by the artificial intelligence (AI) company as a way to detect and redact personally identifiable information (PII) in unstructured text with an aim to incorporate strong privacy and security protections into applications.<\/p>\n

\u00abThe repository had typosquatted OpenAI’s legitimate Privacy Filter release, copied its model card nearly verbatim, and shipped a loader.py file that fetches and executes infostealer malware on Windows machines,\u00bb the HiddenLayer Research Team said<\/a> in a report published last week.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The malicious project instructs users to clone the repository and run a batch script (\u00abstart.bat\u00bb) for Windows or a Python script (\u00abloader.py\u00bb) for Linux or macOS systems to configure all necessary dependencies and start the model.<\/p>\n

<\/p>\n

Once launched, the Python script triggers malicious code responsible for disabling SSL verification, decoding a Base64-encoded URL hosted on JSON Keeper, and using it to extract a command that’s passed to PowerShell for subsequent execution.The use of JSON Keeper, a public JSON paste service, as a dead drop resolver allows the attackers to switch payloads on the fly without the need for modifying the repository.<\/p>\n

The PowerShell command is used to download a batch script from a remote server (\u00abapi.eth-fastscan[.]org\u00bb) and launch it using \u00abcmd.exe.\u00bbThe batch script functions as a second-stage downloader that prepares the environment by elevating its privileges by means of a User Account Control (UAC) prompt, configuring Microsoft Defender Antivirus exclusions, downloading the next-stage binary from the same domain, and setting up a scheduled task that launches a PowerShell script to run the executable.<\/p>\n

Once the scheduled task is launched, the malware waits for two seconds before deleting itself. The final stage is an information stealer that’s designed to take screenshots and harvest data from Discord, cryptocurrency wallets and extensions, system metadata, files such as FileZilla configurations and wallet seed phrases, and web browsers based on the Chromium and Gecko rendering engines.<\/p>\n

\u00abDespite using a scheduled task, this stage establishes no persistence: the task is destroyed before any reboot. It is being used as a one-shot SYSTEM-context launcher,\u00bb HiddenLayer explained.<\/p>\n

The stealer also runs checks to detect debuggers and sandboxes, ascertains it’s not running in a virtual machine, and tries to disable Windows Antimalware Scan Interface (AMSI) and Event Tracing for Windows (ETW) to evade behavioural detection. The stolen data is exfiltrated in JSON format to the \u00abrecargapopular[.]com\u00bb domain.<\/p>\n

\"\"<\/a><\/div>\n

Prior to it being disabled, the model is said to have reached the #1 trending position on Hugging Face with approximately 244,000 downloads and 667 likes within 18 hours.It’s suspected that these numbers were artificially inflated to give the repository an illusion of trust and get users to download it.<\/p>\n

Further analysis of the activity has unearthed six more repositories that feature a similar Python loader to deploy the stealer –<\/p>\n