Android Malware Uses Hugging Face To Distribute

Bitdefender researchers identified an Android campaign that uses counterfeit security apps as first-stage droppers for TrustBastion remote access Trojans, delivering final payloads via Hugging Face's public hosting. Attackers use scareware ads and fake threat alerts to trick users into installing the dropper, which fetches staged APKs from Hugging Face and rotates thousands of package variants to evade detection while targeting banking and payment credentials.