ACVERogue and malicious agent events

Advisories › ACVE-2026-0307

ACVE-2026-0307 · Malicious component · HIGH

Unverified · secondary sources only

WHAT HAPPENED

loader.py runs a hidden fetched command that installs a Rust infostealer, which exfiltrates browser, Discord, wallet, SSH and FTP credentials.

THE SETUP — is yours like this?

Harness
Any Windows host whose user runs start.bat or python loader.py from the repository; the chain fails silently on Linux and macOS, www.hiddenlayer.com
Model
hf:Open-OSS/privacy-filter@3eae35c05f8ae3eca6f3e9c2125c4871f24e14c9 and the six anthfu repositories whose loader.py has SHA-256 6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c, web.archive.org
Goal
Run the trending Privacy Filter repository locally as its README instructs, with start.bat on Windows or python loader.py, www.hiddenlayer.com
Tools
start.bat and loader.py in the repository; loader.py fetches a command from jsonkeeper.com/b/AVNNE and runs it in a hidden window, which downloads the update.bat file and the infostealer from api.eth-fastscan.org, www.hiddenlayer.com
Approval
The user starts the script; loader.py runs the fetched command hidden, with no prompt, www.hiddenlayer.com

WHAT TO CHANGE

Delete the cached repository; if start.bat or loader.py ran on Windows, reimage the host and rotate every credential it held.

  • Remove ~/.cache/huggingface/hub/models--Open-OSS--privacy-filter. Malware lure; removed from the Hub. Owner: operator
  • Remove ~/.cache/huggingface/hub/models--anthfu--*. Repositories carrying the same loader. Owner: operator

HARM, REACH AND RECOVERY

Harm
credential-theft

SOURCES

REPORT

Technical details

A Rust infostealer steals browser, Discord, wallet, SSH and FTP credentials when a Windows user runs start.bat or loader.py from hf:Open-OSS/privacy-filter or an anthfu repository as the README says.

Severity
HIGH
Status
Unverified
Kind
Malicious component
Modified
2026-09-25
Aliases
No CVE assigned — A malicious or poisoned model repository is not a software vulnerability; no CVE applies.
CVE boundary
artifact
Affected
  • Model: hf:Open-OSS/privacy-filter@3eae35c05f8ae3eca6f3e9c2125c4871f24e14c9 — >= 3eae35c05f8ae3eca6f3e9c2125c4871f24e14c9
  • Model: hf:anthfu/Bonsai-8B-gguf#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c — all versions
  • Model: hf:anthfu/Qwen3.6-35B-A3B-APEX-GGUF#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c — all versions
  • Model: hf:anthfu/DeepSeek-V4-Pro#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c — all versions
  • Model: hf:anthfu/Qwopus-GLM-18B-Merged-GGUF#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c — all versions
  • Model: hf:anthfu/Qwen3.6-35B-A3B-Claude-4.6-Opus-Reasoning-Distilled-GGUF#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c — all versions
  • Model: hf:anthfu/supergemma4-26b-uncensored-gguf-v2#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c — all versions
Harness/product
hf:Open-OSS/privacy-filter@3eae35c05f8ae3eca6f3e9c2125c4871f24e14c9 + hf:anthfu/Bonsai-8B-gguf#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c + hf:anthfu/Qwen3.6-35B-A3B-APEX-GGUF#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c + hf:anthfu/DeepSeek-V4-Pro#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c + hf:anthfu/Qwopus-GLM-18B-Merged-GGUF#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c + hf:anthfu/Qwen3.6-35B-A3B-Claude-4.6-Opus-Reasoning-Distilled-GGUF#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c + hf:anthfu/supergemma4-26b-uncensored-gguf-v2#loader.py@sha256:6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c
Classes
loader-lure; credential-theft; supply-chain; CWE-506
Taxonomy
ASI: ASI04; ATLAS: AML.T0115.001; ATLAS: AML.T0074; ATLAS: AML.T0011
First reported
2026-05-07 — HiddenLayer
Input controlled by
package-publisher
Divergence
none
Licence
CC-BY-4.0 advisories; MIT code

Reproducibility: not-reproducible (vulnerable components are not confirmed obtainable)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

In the wild

exploited-itw · 2026-04-24 – 2026-05-07 · dfir

Artifact

Payload
loader-lure · companion-script
Platform status
huggingface · removed (checked 2026-09-21)
C2
jsonkeeper[.]com/b/AVNNE, api.eth-fastscan[.]org, 89.124.93[.]110, recargapopular[.]com
Target
browser, Discord, wallet, SSH and FTP credentials on Windows

File hashes

  • Open-OSS/privacy-filter/loader.py: 6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1
  • Open-OSS/privacy-filter/start.bat: 4fba92a34fd9338293de53444bc9f05c278897d903a24efb95fde0522b3d50c0
  • anthfu/*/loader.py: 6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c

Namespace

Open-OSS

Description

What

Open-OSS/privacy-filter typosquatted OpenAI's Privacy Filter; its README told users to run start.bat or python loader.py. loader.py fetches a command from jsonkeeper[.]com/b/AVNNE and runs it in hidden PowerShell, which downloads update.bat and a Rust infostealer from api[.]eth-fastscan[.]org (89[.]124[.]93[.]110); a sandbox run exfiltrated to recargapopular[.]com. Windows-only. HiddenLayer found it on 7 May 2026 at about 244K downloads, a figure it calls almost certainly inflated; Hugging Face removed it. Six anthfu repositories carried a near-identical loader.py.

Detection

The lockfile sees a cached repository or a script hash. It cannot see whether either script ran, or on Windows.

Fix

Delete the cached repository. If either script ran on Windows, reimage the host and rotate every credential it held.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

some models where
  or
    id regex "^hf:(?:Open-OSS/privacy-filter|anthfu/(?:Bonsai-8B-gguf|Qwen3\\.6-35B-A3B-APEX-GGUF|DeepSeek-V4-Pro|Qwopus-GLM-18B-Merged-GGUF|Qwen3\\.6-35B-A3B-Claude-4\\.6-Opus-Reasoning-Distilled-GGUF|supergemma4-26b-uncensored-gguf-v2))@"
    and
      fileHashes exists
      fileHashes contains "6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1"
    and
      fileHashes exists
      fileHashes contains "6d5b1b7b9b95f2074094632e3962dc21432c2b7dccfbbe2c7d61f724ffcfea7c"
    and
      fileHashes exists
      fileHashes contains "4fba92a34fd9338293de53444bc9f05c278897d903a24efb95fde0522b3d50c0"

Report a problemJSON