Attackers Exploit Hugging Face To Distribute Trojans

Security researchers uncovered a campaign that used Hugging Face’s model repository to distribute Android banking trojans to users across multiple continents. TechRepublic reported attackers uploaded trojanized apps and staged loaders disguised as AI models, enabling credential theft, SMS interception, and persistent device access; the incident prompted removals and renewed calls for stricter repository moderation and behavioral detection.