20260416-bleepingcomputer.com-58779

< Back to index

Hackers exploit Marimo flaw to deploy NKAbuse malware from Hugging Face

Published:

16 April 2026 at 16:58:06

Alert date:

16 April 2026 at 17:02:07

Source:

bleepingcomputer.com

Web Technologies, Ransomware & Malware, Zero-Day Vulnerabilities

Hackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy a new variant of NKAbuse malware. The malware is being hosted on Hugging Face Spaces, demonstrating an abuse of legitimate AI/ML platforms for malicious purposes. This represents an active exploitation campaign targeting Python development environments. The attack leverages the popularity of AI platforms to host and distribute malware payloads. Organizations using Marimo notebooks should implement immediate security measures.

Technical details

Hackers exploit a critical remote code execution vulnerability (CVE-2026-39987) in Marimo reactive Python notebook to deploy NKAbuse malware. The attack uses Hugging Face Spaces to host malware, creating a Space named 'vsccode-modetx' containing dropper script (install-linux.sh) and malware binary 'kagent'. After exploiting Marimo RCE, attackers use curl commands to download and execute scripts from Hugging Face. The payload is a new variant of NKAbuse malware that functions as a remote access trojan, using NKN blockchain for communication. The dropper establishes persistence via systemd, cron, or macOS LaunchAgent. Additional attacks include lateral movement with database credential extraction and Redis server targeting.

Mitigation steps:

Upgrade Marimo to version 0.23.0 or later immediately. If upgrading is not possible, block external access to the '/terminal/ws' endpoint via firewall or block it entirely. Monitor for suspicious curl commands downloading from Hugging Face Spaces.

Affected products:

[object Object]
[object Object]