Reddit NetSec

AlienVault OTX General

CVE Database V5

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new malicious campaign has been discovered targeting the Python Package Index (PyPI) by exploiting the Pickle file format in machine learning models. Three malicious packages posing as an Alibaba AI Labs SDK were detected, containing infostealer payloads hidden inside PyTorch models. The packages exfiltrate information about infected machines and .gitconfig file contents. This attack demonstrates the evolving threat landscape in AI and machine learning, particularly in the software supply chain. The campaign likely targeted developers in China and highlights the need for improved security measures and tools to detect malicious functionality in ML models.

This threat involves a novel malicious campaign targeting the Python Package Index (PyPI) ecosystem by exploiting the Pickle serialization format within machine learning (ML) models, specifically PyTorch models. Attackers have uploaded three malicious packages masquerading as an Alibaba AI Labs SDK, embedding infostealer payloads inside the PyTorch model files. The Pickle format is known for its ability to serialize and deserialize Python objects but is inherently insecure when loading untrusted data, as it can execute arbitrary code during deserialization. By embedding malicious code within these ML models, the attackers leverage the trust developers place in PyPI packages and the opaque nature of ML model files to evade detection. Once installed, these packages exfiltrate sensitive information from infected machines, including details about the system environment and contents of the .gitconfig file, which may contain credentials or configuration details useful for further compromise or lateral movement. This attack represents an evolution in supply chain attacks, combining AI/ML components with traditional malware techniques to target developers and organizations relying on open-source ML tools. Although the campaign appears to have primarily targeted developers in China, the use of PyPI and PyTorch is global, raising concerns about broader exposure. The attack chain exploits the lack of robust security controls around ML model files and the absence of effective scanning tools capable of detecting malicious payloads embedded in serialized ML artifacts. No known exploits are currently reported in the wild beyond this campaign, and no patches or mitigations have been formally released, underscoring the need for heightened vigilance and improved security practices in ML supply chains.

Detailed information about Malicious attack method on hosted ML models now targets PyPI. Get real-time updates, technical details, and mitigation strategies.

Malicious attack method on hosted ML models now targets PyPI - Live Threat Intelligence - Threat Radar | OffSeq.com

Malicious attack method on hosted ML models now targets PyPI

This analysis explores the emerging threat of machine learning model-based breaches, detailing their anatomy, detection methods, and real-world examples. It highlights the risks associated with sharing ML models, particularly through platforms like Hugging Face, and the potential for malicious actors to exploit serialization formats like pickle files. The report outlines various techniques for detecting and analyzing suspicious models, including static scanning, disassembly, memory forensics, and sandboxing. It also presents case studies of actual incidents involving malicious models, demonstrating the urgency of developing specialized incident response capabilities for AI-related threats.

This threat concerns the emerging risk of malicious machine learning (ML) model artifacts being used as vectors for cyberattacks. Attackers exploit the growing practice of sharing ML models on public or semi-public platforms such as Hugging Face by embedding malicious code within the models. A key technique involves abusing serialization formats like Python's pickle files, which allow arbitrary code execution during deserialization. This enables adversaries to conceal malware payloads inside seemingly benign ML artifacts, evading traditional detection mechanisms. The attack anatomy typically involves embedding payloads such as TrickBot, Cobalt Strike, or Metasploit frameworks within the ML model files. Detection is challenging due to the complexity and novelty of ML model formats but can be approached through static scanning for suspicious patterns, disassembly of embedded code, memory forensics to analyze runtime behavior, and sandboxing to observe execution in isolated environments. Real-world incidents have demonstrated that malicious ML models can serve as delivery mechanisms for advanced persistent threats (APTs) and post-exploitation tools. This evolving threat landscape necessitates specialized incident response capabilities tailored to AI-related threats, including enhanced forensic tools and updated security policies around ML artifact sharing and usage. Although no widespread exploits are currently observed in the wild, the medium severity rating reflects the significant potential risk as ML adoption grows in enterprise environments.

Detailed information about Modern Incident Response: Tackling Malicious ML Artifacts. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'machine learning'

Filter Threats

Threats Tagged 'machine learning'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility