ACVE-2026-0307

In the wild

exploited-itw · 2026-04-24 – 2026-05-07 · vendor

Artifact

Payload

loader-lure · companion-script

Platform status

huggingface · removed (checked 2026-09-20)

C2

jsonkeeper[.]com/b/AVNNE, recargapopular[.]com

Target

developer credentials

File hashes

• loader.py: 6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1
• update.bat: 04f0569971ac7ff81c8656e8453a69189d8870040044909dad45c04c567e7564
• payload: ba67720dd115293ec5a12d08be6b0ee982227a4c5e4662fb89269c76556df6e0

Namespace

Open-OSS · orphaned 2026-05-08

Description

What

HiddenLayer found a repository presented as a privacy filter that shipped loader.py, batch files, a PowerShell stage, and a Rust infostealer. The loader contacted jsonkeeper[.]com/b/AVNNE and sent collected material toward recargapopular[.]com. The repository was removed after the campaign and its engagement was judged artificially inflated.

Which configuration is exposed

The exposed setup is a model cache whose model card or operator instructions persuade a user to run the supplied loader or batch file. A normal safetensors or Pickle scanner does not cover this companion-script path. Any developer workstation that gave the loader browser, wallet, SSH, or environment access was within the intended target set.

How ACVE detects it

ACVE matches the published loader.py SHA-256 and records the other exact file hashes as corroborating indicators. The cache path and file hash are independent checks, so a renamed copy remains detectable when the bytes are unchanged. A missing hash leaves the result possible rather than safe.

Fix

Delete the entire repository cache, stop any loader or batch process, and rotate credentials reachable from the host. Block the exact domains and review persistence, browser profiles, SSH material, and wallet stores. Configure model loading so a model cannot cause a companion script to run implicitly.

Grounding needed

The Hub removal state cannot validate old bytes, so the cited HiddenLayer hashes and execution chain should be preserved with an archive. The source supports real-world malicious distribution; it does not provide a reliable victim count.

This record is limited to the condition named in the public source: Hugging Face privacy-filter lure downloads a credential stealer. A match is a review signal for that condition, not a claim that every installation, package, model, or host was compromised. Operators should preserve the resolved evidence and investigate adjacent credentials, network exposure, and execution history before closing the finding. The result should be retained with the lock snapshot used for the match so later review can distinguish configuration drift from a changed public record.

Configuration

some models where
  fileHashes contains "6db01158b044f178c45754666e2cbc0365f394e953fbf99ec34aa5304d5b79b1"

Fix

Remove the repository cache, stop its companion scripts, and rotate developer credentials.

• Remove ~/.cache/huggingface/hub/models--Open-OSS--privacy-filter/**.
• Disable loader.py.
• Reconfigure loaderPolicy.weightsOnly to true. Do not execute companion model scripts as part of loading.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

REPORT

• https://www.hiddenlayer.com/research/malware-found-in-trending-hugging-face-repository-open-oss-privacy-filter
• https://huggingface.co/docs/hub/security-malware