Pluto Security tracks a Hugging Face cryptominer campaign using malicious Qwen2 models, Python loaders, reverse shells, and persistent mining payloads.