At a Glance Malware Family Hugging Face malware campaign (peakminer cryptominer, /tmp/.cch/svc.py watchdog, reconnecting reverse shells, and container escape tools) Threat Actor Unattributed; suspected financially motivated Chinese-speaking operator or group Target / Victims Self-hosted AI infrastructure (Xinference and GPUStack), shared GPU notebooks, research clusters (over 32,000 downloads across 31 campaign and 13 linked repositories) Delivery Vector