Malware Impersonating Qwen Spreads via 487KB File

A GitHub repository impersonating Alibaba's Qwen model has been found to distribute information-stealing malware in a compressed file of approximately 487KB. According to analysis by the SlowMist security team, the repository disguised itself as the Qwen 3.8 27B local quantization model, but the actual file size was only 487KB, far below the expected 16GB for a legitimate model. The compressed file contained a disguised file, a LuaJIT interpreter, and obfuscated Lua scripts. The official Qwen project has not been compromised, and developers are advised to verify the distribution source, file size, and official account status. The malware collects host data and captures screens to send to the attacker's command-and-control server, and it also includes a method to read backup C2 addresses if the hardcoded server fails. SlowMist reported that at least 23 similar GitHub repositories and 29 similar compressed files have been identified. This incident highlights the intersection of AI model ecosystems and blockchain security issues, emphasizing the necessity for developers and virtual asset users to verify files before execution. While there has been no direct impact on the virtual asset market, concerns remain regarding the potential misuse of blockchain infrastructure for malware operations.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.