HuoXing Finance reports that the SlowMist Security Team recently disclosed a malicious GitHub repository impersonating the "Qwen 3.8 27B Local Quantized Model." The repository claimed the model files should exceed 16 GB, but the actual downloaded content was only about 487 KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts. SlowMist emphasized that the official Qwen project has not been compromised. SlowMist analysis revealed that once executed, this malicious program collects host information, takes screenshots, and transmits them to the attacker’s C2 server; when the hardcoded server becomes unreachable, it retrieves alternative C2 addresses from a smart contract on the Polygon chain, allowing attackers to rotate infrastructure via on-chain transactions. Subsequent payloads can steal browser login credentials, cookies, browsing history, email accounts, WinSCP and Steam credentials, as well as files and extension data related to cryptocurrency wallets. SlowMist also found that at least 23 GitHub repositories and 29 similar compressed archives utilize the same Lua delivery chain.
SlowMist Discovers Fake Qwen Model GitHub Repository Used for Malware Distribution
MarsBitShare
Summary
SlowMist discovered a security breach on GitHub involving a fake Qwen 3.8 27B Local Quantized Model repository. The repository falsely claims to contain a 16GB model file but delivers a 487KB package containing hidden malware. The payload includes a LuaJIT interpreter and obfuscated scripts designed to steal host data, screenshots, and sensitive information such as browser cookies and wallet files. Attackers employ a backup C2 address stored in a Polygon contract to rotate infrastructure in case the primary server fails. At least 23 repositories and 29 compressed files use the same method. While inflation data trends are unrelated, users are strongly advised to verify the authenticity of all model downloads to avoid falling victim to this attack.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.