Hugging Face Repositories Hijacked For Android RAT Delivery, Bypassing Traditional Defenses

The report details an active Android RAT campaign (TrustBastion / "Premium Club") that lures users to install a dropper app which fetches polymorphic APKs hosted on Hugging Face; the malware requests Accessibility Services to capture screens, show fake login interfaces (Alipay/WeChat), exfiltrate data to C2 154.198.48.57:5000, and maintain persistence. Attackers use rapid server-side polymorphism (thousands of commits and new APKs every 15 minutes) to evade hash-based detection; Bitdefender observed the campaign, coordinated takedowns, and published IoCs including MD5 hashes.