Fake OpenAI 'Privacy Filter' Repository on Hugging Face — Open-OSS/privacy-filter Drops sefirah Rust Infostealer — Threadlinqs Intelligence
As of 2026-05-30, Fake OpenAI 'Privacy Filter' Repository on Hugging Face — Open-OSS/privacy-filter Drops sefirah Rust Infostealer is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0488 · Severity: HIGH · Status: MONITORING · Category: MALWARE
A typosquatted Hugging Face repository (Open-OSS/privacy-filter) impersonating OpenAI's Privacy Filter project briefly reached #1 trending and accumulated 244,000 downloads before takedown. The
OVERVIEW
On 2026-05-07 HiddenLayer researchers identified a malicious Hugging Face repository, Open-OSS/privacy-filter, that typosquatted OpenAI's legitimate 'Privacy Filter' tooling. The repository briefly reached the #1 trending position on Hugging Face, accumulating approximately 244,000 downloads before community reporting and takedown by the platform. Despite removal of the primary repository, HiddenLayer observed additional repositories under related accounts reusing the same loader infrastructure, indicating an ongoing campaign rather than a single isolated upload.
INFECTION CHAIN
Stage 1 — Python Loader (loader.py): The repository's loader.py is presented as a wrapper that initializes the 'privacy filter' model. In reality the file contains a base64-encoded URL that, once decoded at runtime, points to attacker-controlled infrastructure. The loader spawns a PowerShell process via subprocess with the decoded URL as an argument.
Stage 2 — PowerShell Stager (Invisible Window): The PowerShell command is launched with -WindowStyle Hidden and -ExecutionPolicy Bypass, downloading start.bat from the attacker server and executing it without surfacing any UI. This stager performs three tasks: (1) attempts UAC bypass via Bypass UAC techniques targeting auto-elevation paths to elevate the session, (2) issues Add-MpPreference -ExclusionPath commands to whitelist common drop directories from Microsoft Defender, and (3) downloads the next-stage payload (the sefirah Rust binary) to a Defender-excluded path under the user's AppData hierarchy.
Stage 3 — sefirah Rust Infostealer: sefirah is a previously undocumented Rust-compiled Windows infostealer. Capabilities observed by HiddenLayer include: harvesting Chromium/Gecko browser login data and cookies (with native DPAPI-based decryption of master keys), enumeration and theft of Discord auth tokens from leveldb stores, scraping of cryptocurrency wallet files (Exodus, Atomic, Electrum, MetaMask browser extension storage), collection of SSH private keys (~/.ssh/), FTP client configurations (FileZilla, WinSCP), VPN client credentials (OpenVPN, NordVPN, ProtonVPN configs), and on-demand screen capture. The stealer performs anti-analysis checks before activation: it queries Win32_ComputerSystem for known VM model strings (VMware, VirtualBox, QEMU, Hyper-V), checks for analyst-oriented processes (procmon, wireshark, x32dbg, ida), and uses time-based evasion (NtQueryPerformanceCounter delay sanity checks).
EXFILTRATION
Stolen data is bundled into a ZIP archive and POSTed over HTTPS to recargapopular[.]com. The Spanish-language domain ('recarga popular' translates to 'popular recharge', commonly used by LATAM bill-pay services) suggests either a compromised legitimate site or attacker masquerading. HiddenLayer reports the C2 endpoint accepts a victim ID parameter and writes archives to a victim-specific path on the server.
VICTIMOLOGY
The campaign indiscriminately targets any Hugging Face user who downloads and runs the repository — a population skewed toward AI/ML researchers, software developers, and data scientists who routinely execute model-loading Python from public sources. Because of the repository's brief #1 trending status, exposure was global with concentration in regions with active AI developer communities (United States, Europe, India, Latin America). Defenders should assume any system that executed loader.py from this repository between repo creation and takedown is potentially compromised.
DETECTION & RESPONSE
Defenders should hunt for: PowerShell child processes of python.exe with -WindowStyle Hidden; Add-MpPreference -ExclusionPath commands originating from non-administrative scripts; outbound HTTPS connections to recargapopular[.]com and any IP it has resolved to; presence of files named loader.py with embedded base64-decoded URLs in repositories cloned from Hugging Face; and Defender exclusions added in the past 30 days that have no corresponding change-management record.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494
Target sectors: technology, research, education, ai-ml, software-development, cryptocurrency
Target regions: Global, North America, Europe, Latin America, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1195, T1204, T1059, T1059, T1059, T1140, T1027, T1562