[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHi5Y-uR8YNECvIMrup0z7xPFMHvbpbY-Xde8KHZvrjk":3},{"article":4,"iocs":51,"watch_terms":62,"solutions":63,"lesson":32},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"b5ffdde0-b925-48ab-8d21-4b974323906a","Fake OpenAI repository on Hugging Face pushes infostealer malware","fake-openai-repository-on-hugging-face-pushes-infostealer-malware-084216","A malicious Hugging Face repository that reached the platform's trending list impersonated OpenAI's \"Privacy Filter\" project to deliver information-stealing malware to Windows users. [...]","A typosquatted repository on Hugging Face impersonating OpenAI's \"Privacy Filter\" project briefly reached the platform's trending list and accumulated 244,000 downloads before removal. The malicious repository contained a loader.py script that fetched and executed a Rust-based infostealer targeting browser data, cryptocurrency wallets, SSH credentials, Discord tokens, and system information. The stolen data was exfiltrated to a C2 server at recargapopular[.]com, with researchers noting anti-analysis features and potential overlaps with npm typosquatting campaigns distributing WinOS 4.0.","Malicious Hugging Face repository impersonating OpenAI's Privacy Filter delivers infostealer malware.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Ffake-openai-repository-on-hugging-face-pushes-infostealer-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F03\u002F24\u002Fhacker_box.jpg","2026-05-09T14:26:03+00:00","2026-05-09T16:00:10.643072+00:00",9,[17,20,23,25,27],{"name":18,"type":19},"OpenAI","vendor",{"name":21,"type":22},"Hugging Face","product",{"name":24,"type":22},"Privacy Filter",{"name":26,"type":19},"HiddenLayer",{"name":28,"type":29},"npm","technology","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":30,"icon":32,"name":33,"slug":34},null,"Supply Chain","supply-chain",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,59],{"type":53,"value":54,"context":55},"domain","recargapopular[.]com","C2 server for exfiltrating stolen data",{"type":40,"value":57,"context":58},"sefirah","Rust-based infostealer payload downloaded via loader.py",{"type":40,"value":60,"context":61},"WinOS 4.0","Implant distributed via overlapping npm typosquatting campaign",[18,26,21],{"controls":64,"vendors":146},[65,94,117],{"slug":66,"name":67,"problem":68,"products":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":95,"name":96,"problem":97,"products":98},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[99,105,110],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":100,"product_name":101,"url":103,"description":104},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":106,"product_name":107,"url":108,"description":109},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":111,"product_name":114,"url":115,"description":116},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"slug":118,"name":119,"problem":120,"products":121},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",[147],{"slug":148,"name":26,"logo_path":149,"roles":150},"hiddenlayer","\u002Fvendor-logos\u002Fhiddenlayer.png",[151],"reported_by"]