Fake OpenAI repository on Hugging Face pushes infostealer malware

HiddenLayer discovered a malicious Hugging Face repository that impersonated OpenAI's Privacy Filter, reached the platform's trending list, and delivered a Rust-based infostealer via a loader.py -> PowerShell chain; the malware collects browser data, Discord tokens, cryptocurrency wallets, SSH/FTP credentials and other sensitive files, exfiltrating them to recargapopular.com, and includes extensive anti-analysis and persistence techniques, while victim counts remain unclear and remediation guidance includes reimaging and rotating credentials.