Following disclosure of a critical remote code execution vulnerability in the marimo Python notebook platform, threat actors weaponized this flaw to deploy a blockchain-based botnet via typosquatted HuggingFace Spaces. The malware, an undocumented NKAbuse variant, leveraged the NKN blockchain for command and control. From April 11-14, 2026, eleven unique IPs across ten countries generated 662 exploit events involving reverse shell access, credential theft targeting AWS and API tokens, DNS exfiltration, and lateral movement to PostgreSQL and Redis databases using stolen credentials. The malware binary masqueraded as a legitimate Kubernetes tool called kagent and maintained persistence using systemd services, crontab entries, and macOS LaunchAgents. This operation highlights targeted attacks on AI/ML infrastructure and the use of trusted platforms for malware delivery.

The vulnerability enabled remote code execution without prior authorization, allowing attackers to deploy malware that facilitated reverse shell access, credential theft (including sensitive AWS keys and API tokens), DNS data exfiltration, and lateral movement within victim networks to critical databases such as PostgreSQL and Redis. The malware's persistence mechanisms increase the difficulty of detection and removal. The abuse of trusted platforms like HuggingFace Spaces for malware hosting could undermine trust in AI/ML infrastructure ecosystems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor for typosquatted HuggingFace Spaces and suspicious activity related to marimo notebook deployments. Restricting execution privileges and monitoring for persistence mechanisms such as unauthorized systemd services, crontab entries, and LaunchAgents may help mitigate impact. Review and rotate exposed credentials, especially AWS keys and API tokens, if compromise is suspected.