Trending Hugging Face Repo With 200K Downloads Spreads Windows Malware

A malicious Hugging Face repository (Open-OSS/privacy-filter) abused platform trust and trending mechanisms to distribute a multi-stage attack that used a Python loader to retrieve and execute a PowerShell payload, which downloaded a batch updater that deployed a Rust-based infostealer. The infostealer performs extensive credential and crypto-wallet theft, employs robust anti-analysis and persistence techniques (UAC elevation, Defender exclusions, scheduled task impersonating Microsoft Edge updater), and exfiltrates data to identified C2 domains; the report provides IoCs and recommends host reimaging and credential rotation.