Hugging Face OpenAI Filter Malware

A repository disguised as OpenAI Privacy Filter on Hugging Face reportedly recorded 244,000 downloads before being removed.

The actual file was not a PII-scrubbing tool but a Rust infostealer. It executed via a Windows path, established persistence, and weakened security defenses.

The theft targets are as follows.

• wallets
• browser data
• Discord tokens
• SSH keys
• FTP/VPN creds

This shows the supply chain risk that paths used to download AI models and utilities can also become entry points for malware.