← Catalog
Incident high discovered 2026-05-07

Fake OpenAI 'Privacy Filter' Model on Hugging Face Pushes Infostealer

A repository typosquatting OpenAI's Privacy Filter release copied the model card nearly verbatim and shipped a loader that fetched and ran infostealer malware. It hit #1 trending on Hugging Face with 244,000+ downloads in under 18 hours.

Resource Development Initial Access Execution Impact

What happened

In May 2026, HiddenLayer found malicious code in the Hugging Face repository Open-OSS/privacy-filter, which typosquatted OpenAI’s legitimate Privacy Filter release and copied its model card nearly verbatim. Instead of a model, the repo shipped a loader.py that fetched and executed infostealer malware on Windows machines. It briefly became the top-trending repository on Hugging Face — 244,000+ downloads and 667 likes in under 18 hours — before removal.

The payload stole browser passwords and session cookies, Discord and Telegram tokens, and crypto wallets. It hid its Windows API usage to defeat static analysis, checked for debuggers/VMs (VirtualBox, VMware, QEMU, Xen), and attempted to disable AMSI and ETW to evade behavioral detection. HiddenLayer tied it to six more repos under a separate account and to earlier npm/PyPI typosquatting campaigns — a coordinated AI supply-chain operation trading on OpenAI’s name and the trust users place in a popular model hub.

Why it maps to ATLAS

  • AML.T0058 — Publish Poisoned Models: a malicious artifact is published to a public model hub.
  • AML.T0010.003 — AI Supply Chain Compromise: Model: the attack subverts the model-distribution channel by impersonating a trusted vendor.
  • AML.T0011.000 — User Execution: Unsafe AI Artifacts: running the “model” (its loader) executes attacker code.
  • AML.T0048.003 — External Harms: User Harm: victims’ credentials, tokens, and wallets are stolen.

Detection notes

Trend rank and download count are social proof, not security. A repo name — even one matching a famous vendor — is not proof of authorship, so verify publisher identity and prefer signed, safetensors-based artifacts over code-executing loaders. Load unknown models in a sandbox with no egress, and treat AMSI/ETW tampering and remote-payload fetches from model code as high-fidelity endpoint signals. This is the OpenAI-branded cousin of the Hugging Face Organization Confusion and nullifAI cases.

Detection

Log sources

  • Model/repo provenance + publisher verification
  • Endpoint telemetry on model-load hosts (AMSI/ETW status)
  • Outbound fetch from loader/model code

Signals

  • Repos impersonating a known vendor with copied model cards
  • loader.py-style code fetching and executing remote payloads
  • Code that disables AMSI/ETW or checks for VM/debugger/sandbox

Model repo code fetching + executing a remote payload

alert when model_repo_code matches
  /(urllib|requests|urlopen).*(exec|eval|subprocess|ctypes)/
or matches /(amsi|EtwEventWrite).*patch/i

Mitigations

  • Verify publisher identity; don't trust repo/model names alone
  • Load models in a sandbox with no egress; prefer safetensors over code loaders
  • Endpoint controls that flag AMSI/ETW tampering and infostealer behavior