Microsoft System64 Malware Exfiltrates Data via HuggingFace Datasets

Key Takeaways

• A new, sophisticated malware dubbed MicrosoftSystem64 is actively exfiltrating sensitive data by leveraging HuggingFace’s AI platform as its covert communication channel.
• The threat, attributed to the North Korean group Contagious Interview, infiltrates systems via malicious npm packages, primarily targeting developers.
• MicrosoftSystem64 is cross-platform, affecting Windows, Linux, and macOS, and employs extensive data theft capabilities, including credential harvesting, crypto wallet data, SSH keys, keylogging, and screenshots.
• Despite public disclosure by security researchers, the malware and its command-and-control infrastructure remained operational as of late May 2026.

MicrosoftSystem64 Malware Exploits HuggingFace for Stealthy Data Exfiltration

A recently uncovered malware campaign, identified as MicrosoftSystem64, is actively siphoning sensitive data from compromised machines. This advanced threat achieves its stealth by routing stolen information through HuggingFace, a widely adopted artificial intelligence platform favored by researchers and developers for hosting models and datasets. This innovative approach to data exfiltration signifies a concerning evolution in attacker tactics, enabling malicious actors to blend their illicit traffic with legitimate network activity.

The malware masquerades as a benign Microsoft process, making it exceedingly difficult for conventional security solutions to detect and flag its activities. Its ability to weaponize widely trusted infrastructure for data movement represents a significant challenge for defenders.

Infection Vector and Cross-Platform Reach

The initial compromise typically originates from a poisoned npm package, notably one named “js-logger-pack.” This package underwent 29 iterations since early April 2026, evolving from a basic reconnaissance tool into a full-fledged malware dropper. Once a developer integrates the malicious package into their project, it silently downloads and executes the MicrosoftSystem64 payload.

MicrosoftSystem64 is an 81 MB binary engineered to operate across multiple operating systems: Windows, Linux, and macOS, requiring no pre-installed software. Following deployment, the malware establishes a connection to a remote server, initiates data harvesting, and implements persistence mechanisms to ensure its survival across system reboots.

Researchers at SafeDep detailed in an April 15 report that their analysis first pinpointed the second-stage payload and documented its abuse of HuggingFace, both as a hosting service for its binaries and as a covert channel for data exfiltration. JFrog Research independently corroborated the campaign approximately one week later.

Despite these public disclosures, the threat remained fully operational as of May 28, 2026, with active victim monitoring and uninterrupted attacker infrastructure.

Advanced Capabilities and HuggingFace Integration

MicrosoftSystem64 functions as a potent remote access trojan (RAT) with extensive capabilities. It is designed to extract credentials from 15 different browser families, steal data from over 80 cryptocurrency wallet extensions, hijack Telegram Desktop sessions, pilfer SSH keys, run a continuous keylogger, and capture screenshots every 60 seconds.

All harvested data is then uploaded to private datasets hosted on HuggingFace under the attacker’s account. The malware supports 24 remote commands, granting its operators near-complete control over infected systems.

The unique aspect of this malware lies in its data exfiltration method. Rather than transmitting stolen files to a private command-and-control (C2) server, MicrosoftSystem64 uploads them to private HuggingFace datasets using the platform’s native API. This technique ensures that all outbound traffic appears as legitimate, authenticated HTTPS requests directed to a reputable AI platform, effectively bypassing most network monitoring tools.

Each victim is assigned a unique set of private datasets within the attacker’s HuggingFace account, meticulously organized by machine identity and data type (e.g., screenshots, credentials, SSH keys). The malware also fetches updates from HuggingFace every 24 hours, automatically replacing its binary with newer versions. SafeDep’s live investigation on May 28 confirmed the attacker’s token was still active, revealing over 400 screenshots from two active victims being monitored in near real-time.

Attribution and Persistence

Intelligence links this campaign to “Contagious Interview,” a North Korea-affiliated threat group notorious for targeting developers through tactics such as fake job interviews and compromised open-source packages. The campaign utilized multiple npm publisher accounts, including “js-logger-pack,” “terminal-logger-utils,” “ts-logger-pack,” “pretty-logger-utils,” and “pinno-loggers.”

The malware establishes persistence using platform-specific mechanisms: scheduled tasks and registry keys on Windows, LaunchAgents on macOS, and systemd services with autostart entries on Linux. It cleverly renames its process to “MicrosoftSystem64” in system listings, mimicking a genuine Microsoft background service to further evade detection.

The malware is designed for resilience, automatically reconnecting to its C2 server via WebSocket after any interruption and retrying failed uploads. This ensures that temporary network outages do not result in data loss for the attackers.

What You Should Do

• Audit Dependencies: Immediately scan all project dependencies for packages associated with the jpeek or toskypi clusters, including js-logger-pack, terminal-logger-utils, ts-logger-pack, pretty-logger-utils, and pinno-loggers.
• Isolate Compromised Systems: Any machine found to have installed these packages should be treated as compromised and immediately isolated from the network.
• Rotate Credentials: Promptly rotate all credentials, API tokens, SSH keys, and cryptocurrency wallet seed phrases that may have been present on the compromised machine.
• Enhance Network Monitoring: Implement advanced network monitoring capable of deep packet inspection and behavioral analysis to detect anomalous traffic patterns, even to trusted services like HuggingFace.
• Implement Software Supply Chain Security: Adopt robust software supply chain security practices, including vetting open-source packages and using package integrity checks.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.