SlowMist Discovers Malicious GitHub Repository Impersonating the Qwen Model

KuCoinFlash

Release Time: 2026/08/28 12:53:22

POL

$0.09623.1%

Summary

A recent security breach has been identified by the SlowMist Security Team, which discovered a malicious GitHub repository impersonating the Qwen 3.8 27B local quantized model. The repository falsely claims the model exceeds 16 GB, but the actual download is only 487 KB and contains hidden files, a LuaJIT interpreter, and obfuscated Lua scripts. The malicious software collects system data, takes screenshots, and transmits them to a command-and-control (C2) server. If the primary server becomes unavailable, it retrieves a backup C2 address from a contract on the Polygon blockchain, enabling attackers to rotate their infrastructure via on-chain transactions. Additional payloads can steal browser data, email credentials, Steam account information, and wallet details. Security experts urge users to avoid downloading unverified models, particularly as rising inflation drives more individuals toward digital assets, expanding the potential attack surface.

Odaily Planet Daily reports: The SlowMist security team has disclosed a GitHub repository impersonating the Qwen 3.8 27B local quantized model. Although the repository claims the model size should exceed 16 GB, the actual downloaded content is only about 487 KB, containing disguised files, a LuaJIT interpreter, and obfuscated Lua scripts.

SlowMist emphasized that the official Qwen project has not been compromised; after execution, the malicious program collects host data, takes screenshots, and sends them to the attacker’s C2 server. When the hardcoded server becomes unavailable, it retrieves backup C2 addresses from a contract on the Polygon chain, allowing attackers to rotate their infrastructure via on-chain transactions. Subsequent payloads can steal browser login credentials, cookies, browsing history, email accounts, WinSCP and Steam credentials, as well as wallet-related files and extension data.

Source:Show original

Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.