AI Infrastructure Under Siege as Malware Evolves to Target Model Files

The cybersecurity landscape in 2026 has undergone a disturbing transformation. Malware operators are no longer satisfied with encrypting spreadsheets and stealing passwords. They are now setting their sights on a far more valuable and harder-to-replace target: artificial intelligence infrastructure itself. From ransomware engineered to encrypt machine learning model weights to massive GitHub-based supply chain campaigns designed to trick AI agents, the threat surface has fundamentally shifted.

A New Class of Threat: Ransomware Built for AI Workloads

In July 2026, researchers at Sysdig documented the deployment of a new compiled ransomware strain called ENCFORGE, linked to an AI-agent-driven threat operator designated JADEPUFFER. Unlike traditional file-encrypting malware that targets documents and databases, ENCFORGE was purpose-built to go after the building blocks of modern AI systems: PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors, ONNX interchange files, GGUF models used for local LLM deployment, FAISS vector indexes, Parquet and Arrow training datasets, and NumPy arrays.

The ransomware covers approximately 180 file extensions, with its help text even referencing LoRA fine-tuning adapters and legacy GGML weights as examples. This is not a generic file locker that happens to catch AI files in its net. Researchers concluded the targeting was deliberate, reflecting a strategic shift toward holding AI assets for ransom.

How ENCFORGE Works

ENCFORGE is a UPX-packed Go binary that uses AES-256-CTR encryption for file data, with each per-run symmetric key wrapped under an embedded RSA-2048 public key. Rather than encrypting entire files, it encrypts selected regions, a speed optimization also used by sophisticated ransomware families like LockBit and BlackCat. Encrypted files receive a .locked extension, and the binary kills processes holding files open before encrypting them. It drops ransom notes as README, HOW_TO_DECRYPT, and README_DECRYPT files, then deletes itself after execution.

The entry point for the ENCFORGE attack was a critical vulnerability in Langflow, a popular open-source framework for building AI applications. Langflow versions before 1.3.0 exposed the /api/v1/validate/code endpoint without authentication, allowing any remote attacker to execute arbitrary Python on the server. The flaw, tracked as CVE-2025-3248, carries a CVSS score of 9.8 and has been in CISA’s Known Exploited Vulnerabilities catalog since May 2025.

The Cost of Compromise

Researchers estimate that rebuilding a production AI model once it has been encrypted could cost between $75,000 and $500,000 per model in cloud GPU compute and engineering time. Production environments often run multiple specialized variants on shared storage, meaning a single ENCFORGE run could encrypt multiple models simultaneously. If training data sits on the same host, organizations must reconstruct it before any retraining can begin, compounding both the financial and operational impact.

FakeGit: When Malware Hunts AI Agents

While ENCFORGE represents a direct assault on AI infrastructure, a parallel threat has emerged that exploits the very tools AI practitioners rely on. Security researchers at Island uncovered a massive campaign dubbed FakeGit that created nearly 7,600 malicious GitHub repositories, with more than 800 posing as AI skills or Model Context Protocol (MCP) servers. As of July 2026, the FakeGit operation has recorded over 14 million downloads across GitHub Release assets.

The counterfeit repositories deliver a malware family known as SmartLoader through trojanized ZIP files that trigger a LuaJIT loader chain. SmartLoader then deploys StealC, an information stealer capable of harvesting credentials, session tokens, and sensitive data from compromised systems. The repositories were designed to mimic legitimate consumer and enterprise tools, from Gmail and WhatsApp integrations to Databricks, Jenkins, and Docker tooling.

AgentBaiting: A New Attack Vector

Perhaps the most alarming aspect of FakeGit is an AI-powered evolution researchers call AgentBaiting. This occurs when an AI agent searching for a skill or MCP server independently discovers one of the malicious repositories and proceeds to act on the attacker’s instructions without any human intervention. Testing revealed that Anthropic Claude Code, Google Gemini, and OpenAI ChatGPT were all susceptible to this technique.

A technique originally designed to socially engineer humans now has the capability to deceive AI agents acting on their behalf. When malicious skills or MCP servers are listed on public registries like LubeHub, Glama, MCP.so, and MCP Market, they gain a false sense of legitimacy. Over 600 campaign listings have been flagged across these public registries.

The Broader Ransomware Surge in 2026

These AI-targeted threats are emerging against a backdrop of broader ransomware escalation. Government ransomware attacks rose 13 percent globally in the first half of 2026, reaching 187 incidents. A new ransomware threat actor is emerging roughly every week, according to recent industry reports. Ransomware attacks overall are up 20 percent year-over-year, with groups like The Gentlemen and Qilin battling for dominance in the criminal underground.

The Spirals ransomware, a new stealthy strain, was recently deployed against an Asian IT company, demonstrating increasingly sophisticated evasion techniques. Meanwhile, Microsoft has documented ACR Stealer, an information-stealing malware showing multiple intrusion chains and increased threat activity across enterprise environments.

Defending Against the New Malware Paradigm

Protect AI Infrastructure

• Patch immediately: Upgrade Langflow to version 1.9.1 or later. Multiple critical vulnerabilities have been added to CISA’s KEV catalog, and unpatched instances are actively being exploited.
• Rotate all credentials: Patching does not revoke credentials already harvested through a vulnerable instance. Rotate AI provider keys, cloud credentials, database secrets, and any tokens accessible to the compromised process.
• Remove Docker socket access: The ENCFORGE attack leveraged an exposed Docker socket to break out of the container. Remove /var/run/docker.sock from any container that does not require it, and scope unavoidable access through a narrowly configured proxy.
• Protect model assets: Keep model weights, vector indexes, and training datasets in offline or immutable snapshots. Monitor directories for mass creation of .locked files.

Secure the AI Supply Chain

• Build a reviewed catalog: Maintain a curated list of approved Skills, MCP servers, and agent plugins rather than allowing agents to discover tools freely.
• Sandbox new tools: Evaluate new agent capabilities in an isolated environment before broader rollout to production systems.
• Verify publishers: Check both the publisher identity and the project history before integrating any third-party AI tool or model.
• Monitor agentic pathways: Track what your AI agents are discovering, downloading, and executing in real time to catch malicious behavior early.

The Road Ahead

The convergence of AI adoption and malware evolution represents a defining cybersecurity challenge for 2026 and beyond. Threat actors are not merely using AI to improve their attacks. They are actively targeting AI infrastructure as a primary objective, recognizing that machine learning models, training datasets, and vector databases represent enormous investments of time, compute, and money. When a single ransomware run can destroy months of training work and cost hundreds of thousands of dollars to remediate, the incentive structure for attackers becomes clear.

Organizations must recognize that their AI infrastructure is now a critical asset that requires the same level of protection as their most sensitive databases and financial systems. The era of treating AI development environments as experimental sandboxes is over. In a threat landscape where ransomware is purpose-built to encrypt model weights and supply chain attacks are designed to trick AI agents, comprehensive security must be built into the AI pipeline from the ground up.

The message from the cybersecurity community is unambiguous: patch your tools, protect your models, secure your supply chain, and never assume that AI infrastructure is too specialized to be targeted. The attackers have already proven otherwise.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous