Attackers Using Hugging Face Hosting to Deliver Android RAT Payload

A social-engineering Android campaign distributes a fake security app (TrustBastion, later rebranded to Premium Club) that uses Hugging Face repositories to deliver a second-stage RAT. The malware requests Accessibility permissions to monitor users, capture credentials and screens, maintain persistent remote connections, and exfiltrate data; attackers employ server-side polymorphism with frequent repository commits to evade detection and sustain the campaign.