Fake ‘Antivirus’ App Spreads Android Malware, Steals Banking Credentials

Researchers uncovered a malicious campaign that distributes a fake Android antivirus called TrustBastion via public repositories on Hugging Face; the app lures users with scareware prompts and then activates spyware that can take screenshots, capture lock-screen PINs, and overlay credential-stealing banking pages. The report recommends sticking to official app stores, scrutinizing app details and reviews, avoiding urgent/pop-up update prompts, and enabling built-in protections like Google Play Protect.