Hugging Face abused to spread thousands of Android malware variants

A widespread Android malware campaign used Hugging Face as a trusted repository to distribute thousands of polymorphic APK variants via a dropper called TrustBastion; the payload is a remote access tool that abuses Accessibility Services to display phishing overlays, capture screenshots, steal credentials (e.g., Alipay, WeChat), and maintain persistent C2 communications, with researchers providing IOCs and Hugging Face removing the malicious datasets.