A virus designed to steal information was uploaded to a GitHub repository, masquerading as downloadable weight files for Alibaba's Qwen 3.8 27B model.
The SlowMist security team reported this on August 28th, and anyone running open-source AI models locally could be at risk of data theft.
There is a Fake Qwen AI Model on GitHub
On August 28, the SlowMist security team warned that someone had created a fake page on GitHub that appeared to offer the popular Qwen AI model for download. The page convincingly promised a fully autonomous AI that would ensure user data privacy, but the file size gave away the trap.
The ZIP file size in this fake repository was only 487 KB, less than half a megabyte, while a real 27-billion-parameter AI model takes up over 16 GB of computer space.
The malicious ZIP file, named uncensored_qwen_v2.6.zip, was created on August 20, 2026, and four days later, the attackers edited the README page so that all download links pointed directly to the malicious ZIP file.
The genuine Alibaba Qwen project was not affected by this.
The ZIP archive contained three files: a command file, an executable program, and a script disguised as a certificate. The executable is a renamed version of the LuaJIT interpreter, a tool used by game engines. It is not dangerous by itself, but the script disguised as a certificate file deploys a virus known as StealC.
Once run on a computer, StealC collects the system name, username, machine identifier, and Windows version. It takes a screenshot and then sends all this data to a server controlled by the attackers. The virus can also steal browser login data, cookie files, browsing history, email passwords, and even cryptocurrency wallet information.
The attackers also created a backup system that allows the virus to read a backup server address from a smart contract on the Polygon blockchain in case the main server goes offline. This system allows the attackers to change their server's location without needing to update the virus code on infected computers.
How Often are Trojan Programs Uploaded to GitHub?
SlowMist discovered at least 23 other GitHub repositories and 29 similar ZIP files using the same Lua-based delivery chain. Island.io discovered and reported on a campaign dubbed FakeGit, active since March 2025, which created about 7,600 malicious GitHub repositories and generated over 14 million download events.
Of these 7,600, 800 are specifically designed to mimic AI-related tools, using a method called AgentBaiting. They can even trick AI assistants into recommending them.
In January, Cryptopolitan reported that Alibaba's real Hugging Face models had been downloaded over 700 million times, the highest among all open-source AI systems.
In late June, at least 292 GitHub repositories copying well-known brands were identified. These fake repositories were spreading the BoryptGrab virus, which steals data from 32 different cryptocurrency wallets and 19 web browsers.
Separately, the cybersecurity company InfoStealers described another automated attack called Megalodon, which resulted in the creation of over 5,000 fake repositories in just six hours.
The attackers copy real projects, create convincing README pages, and even use stolen personal data. They also list these fake projects on public AI registries like LobeHub and Glama, making them more trustworthy.
Cryptopolitan wrote about the same tactic when the StopAndProtect operation turned nearly 2,000 hacked WordPress sites into traps for cryptocurrency users.
Island reports that these repositories are created to meet the growing demand for AI capabilities.
