Hugging Face Abused To Spread Blockchain-Based Backdoor In CVE-2026-39987 Attacks

**Executive summary:** Between April 11–14, 2026 threat actors rapidly weaponized a critical unauthenticated RCE in the Marimo notebook platform (CVE-2026-39987), registering 662 exploit events from 11 IP addresses across 10 countries; attackers used a typosquatted Hugging Face Space to host a shell dropper that deployed a Go-based NKAbuse backdoor (named "kagent") leveraging NKN blockchain C2, while performing credential harvesting, database and Redis enumeration, DNS-based out-of-band verification, and establishing cross-platform persistence.