Hugging Face and ClawHub Abused for Malware Distribution

Recent research indicates that threat actors are increasingly abusing legitimate developer platforms to host and distribute malicious payloads. According to SecurityWeek, attackers have pivoted toward using Hugging Face and ClawHub to bypass traditional security perimeters, leveraging the inherent trust associated with these services to facilitate Phishing and malware delivery campaigns.

Overview of the Abuse Campaign

The campaign focuses on social engineering as the primary initial access vector. Threat actors create repositories or projects that appear legitimate, often centered around high-interest topics such as artificial intelligence models, software cracks, or utility tools. By hosting malicious files on Hugging Face—a platform primarily used for machine learning models—attackers exploit the lack of rigorous file scanning on many specialized code-hosting sites. This allows them to deliver TTP such as script-based loaders and information stealers without immediate detection by basic web filters.

Technical Analysis of Platform Abuse

The attack chain typically begins when a user is lured into downloading a ZIP archive or an LNK file. These files often contain obfuscated PowerShell scripts or batch files designed to pull secondary payloads from external repositories.

How to Detect Malware on Hugging Face Repositories

Security teams SOC analysts should focus on detecting malware on Hugging Face repositories by monitoring for unusual network activity originating from developer tools. Attackers utilize the platform’s ‘Spaces’ or repository hosting to store malicious binary data. When a user clones a repository or downloads a model, an accompanying script may execute in the background to establish a C2 connection. Detection involves inspecting the __init__.py or other setup scripts within Python environments for hardcoded URLs or base64-encoded strings that trigger unexpected network requests.

The Role of ClawHub in Malicious Delivery

ClawHub, a less prominent code-hosting platform, has also been identified as a staging ground for malicious assets. Unlike larger platforms that may have more active security moderation, smaller services like ClawHub provide a persistent hosting environment for malicious scripts. Attackers use these sites as a Content Delivery Network (CDN) to serve small, text-based payloads like PowerShell commands that disable EDR components or download the final stage of the malware. This method of using legitimate infrastructure makes it difficult for a SIEM to distinguish between a developer’s routine update and a malicious file retrieval.

Payload Analysis: Lumma Stealer and More

The primary objective of these campaigns is often the deployment of information stealers, such as Lumma Stealer. Once executed, the malware searches for browser data, cryptocurrency wallets, and session tokens. The use of Hugging Face and ClawHub as distribution points ensures that the initial download appears as a trusted connection to a known developer resource, effectively circumventing many reputation-based filtering systems.

Mitigation and Defense Strategies

To counter these threats, organizations must move beyond simple domain whitelisting. Since blocking Hugging Face or GitHub is often impossible for development teams, a Zero Trust approach to file execution is necessary.

ClawHub Malicious File Distribution Defense

A comprehensive ClawHub malicious file distribution defense strategy requires the enforcement of PowerShell Constrained Language Mode and the use of AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unsigned scripts. Furthermore, security teams should look for specific IoC such as:

• Unexpected PowerShell processes spawning from web browsers or archive utilities.
• Network connections to Hugging Face or ClawHub subdomains from processes other than git, pip, or known developer tools.
• LNK files located in the ‘Downloads’ folder that execute cmd.exe or powershell.exe with hidden window arguments.

By focusing on the behavior of the files rather than the reputation of the hosting domain, defenders can better identify when trusted platforms are being weaponized against their environment.