Forensic Summary
A malicious Hugging Face repository impersonated OpenAI's legitimate Privacy Filter model, cloning its description verbatim to gain credibility and reach the platform's trending list with 244,000 downloads. The repository delivered a multi-stage attack chain culminating in a Rust-based information stealer targeting browser credentials, cryptocurrency wallets, and Discord data on Windows machines. The attack leveraged a dead-drop resolver pattern via a public JSON paste service, allowing operators to swap payloads without modifying the repository itself.
Read the full technical deep-dive on Grid the Grey: https://gridthegrey.com/posts/typosquatted-openai-repo-on-hugging-face-delivered-rust-infostealer-to-244k/
Top comments (0)