Case hf-fake-openai-privacy-filterAI supply chainWorldwide
Fake 'OpenAI Privacy Filter' repo tops Hugging Face trending while pushing Rust infostealer
HiddenLayer found Open-OSS/privacy-filter, a copy of OpenAI's Privacy Filter model card whose loader.py pulled a PowerShell chain that added Defender exclusions and ran a Rust stealer; it reached number one trending with 244,000 likely inflated downloads.
HighAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- May 7, 2026
- Location
- Worldwide
- Target
- Hugging Face users downloading OpenAI releases
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
HiddenLayer found Open-OSS/privacy-filter, a copy of OpenAI's Privacy Filter model card whose loader.py pulled a PowerShell chain that added Defender exclusions and ran a Rust stealer; it reached number one trending with 244,000 likely inflated downloads.
Impact: About 244,000 reported downloads and 667 likes in under 18 hours, mostly inflated; real victim count unclear; Windows victims had credentials and wallets exfiltrated
Who triggered it
Actor: Unknown
Attribution: Same loader infrastructure as six repositories under the account anthfu uploaded April 24; overlaps with an npm typosquatting campaign delivering the WinOS 4.0 implant
Motive: Theft of browser data, Discord tokens, crypto wallets and SSH, FTP and VPN credentials
How it happened
Attack vector: Typosquatted Hugging Face repository with a benign-looking loader.py that disabled SSL checks and fetched a PowerShell command from a paste service
Root cause: Trending rankings manipulated with auto-generated accounts; model hub users running loader scripts from unverified namespaces
Timeline
- Six repositories by anthfu uploaded with the same malicious loader
- HiddenLayer identifies privacy-filter at the top of trending and reports it
- Hugging Face disables access and removes the repository
Response
Hugging Face removed the repository for terms violation; researchers advised reimaging, rotating credentials and replacing wallets
Current status: Resolved
Sources (open in a new tab)
- HiddenLayer hiddenlayer.com
- BleepingComputer bleepingcomputer.com
- PCrisk pcrisk.com
Cite this case
Fake 'OpenAI Privacy Filter' repo tops Hugging Face trending while pushing Rust infostealer. AI Threat Watch, case hf-fake-openai-privacy-filter, May 7, 2026. https://aithreat.io/cases/hf-fake-openai-privacy-filter/
Permanent link: https://aithreat.io/cases/hf-fake-openai-privacy-filter/