Fake OpenAI Privacy Filter Repo Hits #1 on Hugging Face, Draws 244K Downloads
Fake OpenAI Privacy Filter repo on Hugging Face delivers Rust infostealer, hits #1 trending with 244K downloads.
A malicious Hugging Face repository impersonated OpenAI's legitimate Privacy Filter model, reaching #1 on the platform's trending list with 244,000 downloads in 18 hours. The typosquatted project included a loader script that deployed a Rust-based information stealer targeting Windows users, harvesting Discord credentials, cryptocurrency wallets, browser data, and system metadata. HiddenLayer researchers identified six additional malicious repositories using similar Python loaders to distribute the same infostealer.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenAI?
Get an email when a new story names OpenAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — api.eth-fastscan.org
- domain — recargapopular.com
- domain — jsonkeeper.com
- malware — Privacy Filter Infostealer