Fake OpenAI “Privacy Filter” Repo on Hugging Face Distributes Malware, Hits 244 k Downloads

A malicious repository that masqueraded as OpenAI’s “Privacy Filter” project briefly rose to the top of Hugging Face’s trending list, amassing an estimated 244,000 downloads before the platform removed it. The repo, named Open‑OSS/privacy‑filter, contained a loader.py script that disabled SSL verification, decoded a base64‑encoded URL, and fetched a JSON payload. The payload instructed PowerShell to download a start.bat script that performed privilege escalation, added the final payload—named “sefirah”—to Microsoft Defender exclusions, and executed it. The Rust‑based infostealer that followed stole browser data from Chromium and Gecko browsers, Discord tokens, local databases, cryptocurrency wallets, SSH/FTP/VPN credentials, sensitive local files, system information, and multi‑monitor screenshots, then exfiltrated the data to a command‑and‑control server at recargapopular.com. The malware also contained anti‑analysis checks for virtual machines, sandboxes, debuggers, and other analysis tools.

HiddenLayer researchers noted that 667 accounts had liked the repository, many of which appeared auto‑generated, suggesting that the download count may be inflated. They also discovered that the same loader infrastructure was used in other malicious repos, including an npm typosquatting campaign that distributed the WinOS 4.0 implant. The discovery prompted Hugging Face to remove the repo and issue a warning to users who had downloaded it.

Users who pulled the repository are advised to reimage their machines, rotate all stored credentials, replace cryptocurrency wallets and seed phrases, and invalidate browser sessions and tokens. The incident highlights the growing threat of deceptive open‑source projects that exploit the trust of developers and the importance of rigorous vetting of code hosted on public platforms.