A fake OpenAI repository on Hugging Face reached the trending #1 spot before getting caught - 244,000 downloads delivered an infostealer that grabs browser passwords, crypto wallets, and Discord tokens

HiddenLayer disclosed a malicious Hugging Face repository called Open-OSS/privacy-filter that typosquatted OpenAI's legitimate Privacy Filter project. The repo copied the original model card almost verbatim and shipped a loader.py file that, on Windows, fetched and executed an infostealer. The repo briefly hit Hugging Face's trending list at #1 and accumulated 244,000 downloads before the platform pulled it on May 7. The loader runs in an invisible PowerShell window, escalates privileges, adds itself to Microsoft Defender exclusions, and deploys Sefirah - a Rust-based infostealer that targets browser credentials, Discord tokens, cryptocurrency wallets, and SSH keys.

Check

Search proxy and DNS logs for connections to Hugging Face repository 'Open-OSS/privacy-filter' or downloads of 'loader.py' tied to it since April. Hunt Windows endpoints for sefirah.exe and unfamiliar Microsoft Defender exclusions.

Affected

Windows machines whose users downloaded from Open-OSS/privacy-filter between late April and May 7. AI/ML developers are the highest-risk role. Acute risk: developers whose machines hold cryptocurrency wallets, Discord tokens, and SSH keys to production. Cryptocurrency holders specifically targeted by Sefirah's wallet-extraction modules.

Fix

Block Open-OSS/privacy-filter at the network egress layer. For machines that may have run the loader: rotate every browser-stored credential, Discord token, SSH key, and cryptocurrency wallet seed. Enforce signature verification for Hugging Face models pulled into production. Treat all Hugging Face repositories as untrusted by default. Apply HiddenLayer's published Sefirah IoCs.