Attackers Using Hugging Face Hosting to Deliver Android RAT Payload
An emerging Android threat campaign leverages social engineering and a legitimate machine learning platform to disseminate malware. Users encounter deceptive security alerts that prompt them to download a fake security application named TrustBastion,…
An emerging Android threat campaign leverages social engineering and a legitimate machine learning platform to disseminate malware. Users encounter deceptive security alerts that prompt them to download a fake security application named TrustBastion, which serves as a gateway for a complex infection chain, granting attackers control over compromised Android devices.
The campaign exploits the Hugging Face platform, commonly used for sharing machine learning models and datasets, to host and deliver malicious payloads. This trusted service is abused to circumvent security measures that may block suspicious domains.
After installation, TrustBastion displays a fake update notification resembling legitimate Google Play or Android system dialogs. When users attempt to update, the app connects to a server, redirecting them to a Hugging Face repository hosting the actual malicious application. This two-stage delivery process aids in evading detection and enhancing the infection success rate.
An emerging Android threat campaign leverages social engineering and a legitimate machine learning platform to disseminate malware.
How Attackers Maintain Control and Steal Data
Upon installation, the malicious payload requests critical permissions under the guise of a legitimate security feature. The most significant permission is Accessibility Services, granting the malware extensive visibility into user activities. This access enables the malware to monitor user actions, capture screenshots, record screens, and display fake login screens to steal financial credentials from applications such as Alipay and WeChat.
The malware also captures lock screen data and maintains communication with a remote server via persistent connections, allowing real-time data transmission and command reception. Researchers identified server-side polymorphism, with new malware versions generated approximately every fifteen minutes. This approach involves minor variations to evade detection based on file hashes.
Over twenty-nine days, the original repository accumulated over six thousand commits. When the initial TrustBastion repository was removed in December 2025, attackers reinitiated the campaign with a new app name, Premium Club, using the same code to evade detection.
Based on reporting by Cyber Security News.