Android RAT Uses Hugging Face to Host Malware

Bitdefender reported an active Android RAT campaign branded TrustBastion that uses Hugging Face repositories to host polymorphic APK payloads. The attack chain uses a dropper that redirects to Hugging Face, prompts victims to install faux updates, and then enables Accessibility and screen-capture permissions to harvest credentials (including from payment apps) and exfiltrate data; the operation is automated, persistent, and has multiple thousands of commits and likely thousands of victims.