# Fake OpenAI 'Privacy Filter' Repository on Hugging Face — Open-OSS/privacy-filter Drops sefirah Rust Infostealer

> A typosquatted Hugging Face repository (Open-OSS/privacy-filter) impersonating OpenAI's Privacy Filter project briefly reached #1 trending and accumulated 244,000 downloads before takedown. The malicious loader.py fetches a base64-decoded URL, executes PowerShell in an invisible window that downloads start.bat (privilege escalation, Defender exclusions), then drops a Rust-based infostealer named sefirah that exfiltrates browser data, Discord tokens, crypto wallets, SSH/FTP/VPN credentials, and screenshots to recargapopular[.]com. Discovered by HiddenLayer on 2026-05-07.

- **Published:** 2026-05-09T12:00:00Z
- **Last reviewed:** 2026-05-09T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0488
- **ID:** TL-2026-0488
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

OVERVIEW
On 2026-05-07 HiddenLayer researchers identified a malicious Hugging Face repository, Open-OSS/privacy-filter, that typosquatted OpenAI's legitimate 'Privacy Filter' tooling. The repository briefly reached the #1 trending position on Hugging Face, accumulating approximately 244,000 downloads before community reporting and takedown by the platform. Despite removal of the primary repository, HiddenLayer observed additional repositories under related accounts reusing the same loader infrastructure, indicating an ongoing campaign rather than a single isolated upload.

INFECTION CHAIN
Stage 1 — Python Loader (loader.py): The repository's loader.py is presented as a wrapper that initializes the 'privacy filter' model. In reality the file contains a base64-encoded URL that, once decoded at runtime, points to attacker-controlled infrastructure. The loader spawns a PowerShell process via subprocess with the decoded URL as an argument.

Stage 2 — PowerShell Stager (Invisible Window): The PowerShell command is launched with -WindowStyle Hidden and -ExecutionPolicy Bypass, downloading start.bat from the attacker server and executing it without surfacing any UI. This stager performs three tasks: (1) attempts UAC bypass via Bypass UAC techniques targeting auto-elevation paths to elevate the session, (2) issues Add-MpPreference -ExclusionPath commands to whitelist common drop directories from Microsoft Defender, and (3) downloads the next-stage payload (the sefirah Rust binary) to a Defender-excluded path under the user's AppData hierarchy.

Stage 3 — sefirah Rust Infostealer: sefirah is a previously undocumented Rust-compiled Windows infostealer. Capabilities observed by HiddenLayer include: harvesting Chromium/Gecko browser login data and cookies (with native DPAPI-based decryption of master keys), enumeration and theft of Discord auth tokens from leveldb stores, scraping of cryptocurrency wallet files (Exodus, Atomic, Electrum, MetaMask browser extension storage), collection of SSH private keys (~/.ssh/), FTP client configurations (FileZilla, WinSCP), VPN client credentials (OpenVPN, NordVPN, ProtonVPN configs), and on-demand screen capture. The stealer performs anti-analysis checks before activation: it queries Win32_ComputerSystem for known VM model strings (VMware, VirtualBox, QEMU, Hyper-V), checks for analyst-oriented processes (procmon, wireshark, x32dbg, ida), and uses time-based evasion (NtQueryPerformanceCounter delay sanity checks).

EXFILTRATION
Stolen data is bundled into a ZIP archive and POSTed over HTTPS to recargapopular[.]com. The Spanish-language domain ('recarga popular' translates to 'popular recharge', commonly used by LATAM bill-pay services) suggests either a compromised legitimate site or attacker masquerading. HiddenLayer reports the C2 endpoint accepts a victim ID parameter and writes archives to a victim-specific path on the server.

VICTIMOLOGY
The campaign indiscriminately targets any Hugging Face user who downloads and runs the repository — a population skewed toward AI/ML researchers, software developers, and data scientists who routinely execute model-loading Python from public sources. Because of the repository's brief #1 trending status, exposure was global with concentration in regions with active AI developer communities (United States, Europe, India, Latin America). Defenders should assume any system that executed loader.py from this repository between repo creation and takedown is potentially compromised.

DETECTION & RESPONSE
Defenders should hunt for: PowerShell child processes of python.exe with -WindowStyle Hidden; Add-MpPreference -ExclusionPath commands originating from non-administrative scripts; outbound HTTPS connections to recargapopular[.]com and any IP it has resolved to; presence of files named loader.py with embedded base64-decoded URLs in repositories cloned from Hugging Face; and Defender exclusions added in the past 30 days that have no corresponding change-management record. SOC teams should query EDR for Rust-compiled binaries in user AppData paths whose imports include CryptUnprotectData, and for ZIP archives created in temp paths immediately preceding outbound HTTPS to unknown domains.

BROADER IMPLICATIONS
This campaign reinforces that ML/AI model registries (Hugging Face, PyPI, npm, NuGet) are now mainstream supply-chain attack surfaces. Trending or download-count signals can be gamed quickly, and brand impersonation of major AI vendors (OpenAI, Anthropic, Google) provides high social engineering leverage. Organizations should treat model and code downloads from public registries with the same caution as binary downloads, sandbox first-run executions, and apply allow-lists for repositories used in production pipelines.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1564 Hide Artifacts
- T1036 Masquerading
- T1548 Abuse Elevation Control Mechanism
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1057 Process Discovery
- T1113 Screen Capture
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Fake OpenAI repository on Hugging Face pushes infostealer malware](https://www.bleepingcomputer.com/news/security/fake-openai-repository-on-hugging-face-pushes-infostealer-malware/)
- [HiddenLayer research on Open-OSS/privacy-filter campaign](https://hiddenlayer.com/research/)
- [MITRE ATT&CK T1195.002 — Compromise Software Supply Chain](https://attack.mitre.org/techniques/T1195/002/)
- [MITRE ATT&CK T1059.001 — PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [MITRE ATT&CK T1555.003 — Credentials from Web Browsers](https://attack.mitre.org/techniques/T1555/003/)
- [Hugging Face — Content Policy and Trust & Safety](https://huggingface.co/content-guidelines)
- [CISA Alert — Software Supply Chain Risk Management](https://www.cisa.gov/topics/cyber-threats-and-advisories/software-supply-chain)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0488