Fake OpenAI 'Privacy Filter' Repository on Hugging Face — Open-OSS/privacy-filter Drops sefirah Rust Infostealer
Fake OpenAI 'Privacy Filter' Repository on Hugging Face (TL-2026-0488), also tracked as sefirah, is a high-severity malware campaign, first published 2026-05-09. It has no confirmed attribution, affects Hugging Face Hugging Face Hub (model registry), maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0488
- Threat ID
- TL-2026-0488
- Also known as
- sefirah, Open-OSS/privacy-filter campaign, Fake OpenAI Privacy Filter
- Severity
- HIGH
- Status
- MONITORING
- Category
- MALWARE
- First published
- 2026-05-09
- Last reviewed
- 2026-05-09
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, research, education, ai-ml, software-development, cryptocurrency
- Target regions
- Global, North America, Europe, Latin America, Asia
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Fake OpenAI 'Privacy Filter' Repository on Hugging Face
Malware and tooling: Open-OSS/privacy-filter loader, sefirah, sefirah
A typosquatted Hugging Face repository (Open-OSS/privacy-filter) impersonating OpenAI's Privacy Filter project briefly reached #1 trending and accumulated 244,000 downloads before takedown. The malicious loader.py fetches a base64-decoded URL, executes PowerShell in an invisible window that downloads start.bat (privilege escalation, Defender exclusions), then drops a Rust-based infostealer named sefirah that exfiltrates browser data, Discord tokens, crypto wallets, SSH/FTP/VPN credentials, and screenshots to recargapopular[.]com. Discovered by HiddenLayer on 2026-05-07.
How Fake OpenAI 'Privacy Filter' Repository on Hugging Face works
OVERVIEW On 2026-05-07 HiddenLayer researchers identified a malicious Hugging Face repository, Open-OSS/privacy-filter, that typosquatted OpenAI's legitimate 'Privacy Filter' tooling. The repository briefly reached the #1 trending position on Hugging Face, accumulating approximately 244,000 downloads before community reporting and takedown by the platform. Despite removal of the primary repository, HiddenLayer observed additional repositories under related accounts reusing the same loader infrastructure, indicating an ongoing campaign rather than a single isolated upload.
INFECTION CHAIN Stage 1 — Python Loader (loader.py): The repository's loader.py is presented as a wrapper that initializes the 'privacy filter' model. In reality the file contains a base64-encoded URL that, once decoded at runtime, points to attacker-controlled infrastructure. The loader spawns a PowerShell process via subprocess with the decoded URL as an argument.
Stage 2 — PowerShell Stager (Invisible Window): The PowerShell command is launched with -WindowStyle Hidden and -ExecutionPolicy Bypass, downloading start.bat from the attacker server and executing it without surfacing any UI. This stager performs three tasks: (1) attempts UAC bypass via Bypass UAC techniques targeting auto-elevation paths to elevate the session, (2) issues Add-MpPreference -ExclusionPath commands to whitelist common drop directories from Microsoft Defender, and (3) downloads the next-stage payload (the sefirah Rust binary) to a Defender-excluded path under the user's AppData hierarchy.
Stage 3 — sefirah Rust Infostealer: sefirah is a previously undocumented Rust-compiled Windows infostealer. Capabilities observed by HiddenLayer include: harvesting Chromium/Gecko browser login data and cookies (with native DPAPI-based decryption of master keys), enumeration and theft of Discord auth tokens from leveldb stores, scraping of cryptocurrency wallet files (Exodus, Atomic, Electrum, MetaMask browser extension storage), collection of SSH private keys (~/.ssh/), FTP client configurations (FileZilla, WinSCP), VPN client credentials (OpenVPN, NordVPN, ProtonVPN configs), and on-demand screen capture. The stealer performs anti-analysis checks before activation: it queries Win32_ComputerSystem for known VM model strings (VMware, VirtualBox, QEMU, Hyper-V), checks for analyst-oriented processes (procmon, wireshark, x32dbg, ida), and uses time-based evasion (NtQueryPerformanceCounter delay sanity checks).
EXFILTRATION Stolen data is bundled into a ZIP archive and POSTed over HTTPS to recargapopular[.]com. The Spanish-language domain ('recarga popular' translates to 'popular recharge', commonly used by LATAM bill-pay services) suggests either a compromised legitimate site or attacker masquerading. HiddenLayer reports the C2 endpoint accepts a victim ID parameter and writes archives to a victim-specific path on the server.
VICTIMOLOGY The campaign indiscriminately targets any Hugging Face user who downloads and runs the repository — a population skewed toward AI/ML researchers, software developers, and data scientists who routinely execute model-loading Python from public sources. Because of the repository's brief #1 trending status, exposure was global with concentration in regions with active AI developer communities (United States, Europe, India, Latin America). Defenders should assume any system that executed loader.py from this repository between repo creation and takedown is potentially compromised.
DETECTION & RESPONSE Defenders should hunt for: PowerShell child processes of python.exe with -WindowStyle Hidden; Add-MpPreference -ExclusionPath commands originating from non-administrative scripts; outbound HTTPS connections to recargapopular[.]com and any IP it has resolved to; presence of files named loader.py with embedded base64-decoded URLs in repositories cloned from Hugging Face; and Defender exclusions added in the past 30 days that have no corresponding change-management record. SOC teams should query EDR for Rust-compiled binaries in user AppData paths whose imports include CryptUnprotectData, and for ZIP archives created in temp paths immediately preceding outbound HTTPS to unknown domains.
BROADER IMPLICATIONS This campaign reinforces that ML/AI model registries (Hugging Face, PyPI, npm, NuGet) are now mainstream supply-chain attack surfaces. Trending or download-count signals can be gamed quickly, and brand impersonation of major AI vendors (OpenAI, Anthropic, Google) provides high social engineering leverage. Organizations should treat model and code downloads from public registries with the same caution as binary downloads, sandbox first-run executions, and apply allow-lists for repositories used in production pipelines.
MITRE ATT&CK techniques used in TL-2026-0488
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518 Software Discovery
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Initial Access
Credential Access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Resource Development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
defense-impairment
Affected products and versions in Fake OpenAI 'Privacy Filter' Repository on Hugging Face
- Hugging Face — Hugging Face Hub (model registry)
Vulnerable versions: public repositories
Fixed in: Open-OSS/privacy-filter removed by platform - Microsoft — Windows
Vulnerable versions: Windows 10; Windows 11 - Multiple — Browser credential stores (Chromium-based, Gecko-based)
Vulnerable versions: all current - Discord — Discord Desktop
Vulnerable versions: all current
Remediation for Fake OpenAI 'Privacy Filter' Repository on Hugging Face
Patches
- No vendor patch — this is a malicious-package supply-chain campaign, not a software vulnerability
- Hugging Face has removed the primary Open-OSS/privacy-filter repository; report any clones using the same loader infrastructure
Immediate actions
- Block recargapopular[.]com at DNS, proxy, and firewall layers
- Identify hosts that downloaded or executed the Open-OSS/privacy-filter repository and isolate them
- Rotate credentials for any browser-stored logins, Discord tokens, SSH keys, FTP/VPN profiles on potentially affected hosts
- Audit Microsoft Defender exclusions added in the last 30 days; remove any unauthorized ExclusionPath entries
- Hunt for python.exe spawning powershell.exe with -WindowStyle Hidden in EDR telemetry
Workarounds
- Disable automatic execution of model-loader scripts; review loader.py and any setup hooks before running
- Run untrusted Hugging Face downloads in a network-isolated VM with no access to credential stores
- Use Tamper Protection on Microsoft Defender to block unauthorized ExclusionPath additions
Longer-term hardening
- Implement allow-listing for Hugging Face / PyPI / npm repositories used by ML and engineering teams
- Sandbox first-run executions of newly downloaded model-loader scripts in isolated environments
- Deploy EDR rules that flag PowerShell child processes of language interpreters (python, node, ruby)
- Monitor Defender ExclusionPath additions via 4719/event log forwarding to SIEM
- Train ML/AI developers on supply-chain risk indicators including typosquatting and trending-abuse patterns
- Mandate code review of any third-party loader.py / setup.py before execution in dev environments
Weaknesses (CWE) in Fake OpenAI 'Privacy Filter' Repository on Hugging Face
CWE-506, CWE-829, CWE-494
Timeline of Fake OpenAI 'Privacy Filter' Repository on Hugging Face
- Open-OSS/privacy-filter repository uploaded to Hugging Face Hub, masquerading as OpenAI's Privacy Filter project (estimated based on accumulated download timing).
- Repository reaches #1 trending position on Hugging Face, accelerating downloads through algorithmic promotion.
- Repository accumulates approximately 244,000 downloads from a global audience of AI/ML developers and data scientists.
- HiddenLayer notifies Hugging Face Trust & Safety and provides IOCs including the recargapopular[.]com C2 endpoint.
- HiddenLayer researchers identify the malicious loader.py and the multi-stage infection chain ending in the sefirah Rust infostealer.
- Hugging Face removes Open-OSS/privacy-filter; HiddenLayer observes related repositories using the same loader infrastructure remaining online.
- BleepingComputer publishes public reporting on the campaign, including IOCs and infection chain analysis.
- As of 2026-05-29, the primary Open-OSS/privacy-filter repo and 6 related 'anthfu' repos were removed by Hugging Face after HiddenLayer's May 7-8 disclosure, so the immediate delivery channel is contained. However the sefirah stealer, reused loader infrastructure, and tie-in to a broader ongoing npm/PyPI/WinOS supply-chain operation (reported as Silver Fox) keep the actor and TTPs a live, resurgent concern.
Sources cited for Fake OpenAI 'Privacy Filter' Repository on Hugging Face
- Fake OpenAI repository on Hugging Face pushes infostealer malware
- HiddenLayer research on Open-OSS/privacy-filter campaign
- MITRE ATT&CK T1195.002 — Compromise Software Supply Chain
- MITRE ATT&CK T1059.001 — PowerShell
- MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools
- MITRE ATT&CK T1555.003 — Credentials from Web Browsers
- Hugging Face — Content Policy and Trust & Safety
- CISA Alert — Software Supply Chain Risk Management
Threats related to Fake OpenAI 'Privacy Filter' Repository on Hugging Face
- Infostealer Campaigns (Lumma, RedLine, StealC) Harvesting AI Coding Agent and Developer Platform Credentials at Scale
- Typosquatted npm Package postcss-minify-selector-parser Delivers Nuitka-Compiled Windows RAT with RC4-Encrypted HTTP C2
- Fake Roblox Xeno Script Launcher Pushes Multi-Stage Java-Based Infostealer and RAT Malware (Powercat Campaign)
- Roblox Developer Group Takeovers via Malicious 'robase' Python Package and Discord Job-Offer Social Engineering
- Remus Stealer: 64-bit Lumma-Derived Infostealer-as-a-Service with EtherHiding Blockchain C2 and Application-Bound Encryption Bypass
Detection coverage for TL-2026-0488
As of 2026-05-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0488 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.