{"id":209720,"date":"2026-01-29T17:08:00","date_gmt":"2026-01-29T22:08:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/01\/29\/hugging-face-abused-to-spread-thousands-of-android-malware-variants\/"},"modified":"2026-02-03T19:00:17","modified_gmt":"2026-02-04T00:00:17","slug":"hugging-face-abused-to-spread-thousands-of-android-malware-variants","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/01\/29\/hugging-face-abused-to-spread-thousands-of-android-malware-variants\/","title":{"rendered":"Hugging Face abused to spread thousands of Android malware variants"},"content":{"rendered":"

Hugging Face abused to spread thousands of Android malware variants<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/hugging-face-abused-to-spread-thousands-of-android-malware-variants\/<\/a><\/p>\n

Publish Date: 2026-01-29 17:08:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

A new Android malware campaign is using the Hugging Face platform as a repository for thousands of variations of an APK payload that collects credentials for popular financial and payment services.<\/p>\n

Hugging Face is a popular platform that hosts and distributes artificial intelligence (AI), natural language processing (NLP), and machine learning (ML) models, datasets, and applications.<\/p>\n

It is considered a trusted platform unlikely to trigger security warnings, but bad actors have abused it in the past to host\u00a0malicious AI models.<\/p>\n

\"Wiz\"<\/p>\n

The recent campaign discovered by researchers at Romanian cybersecurity company Bitdefender leverages the platform to distribute Android malware.<\/p>\n

The attack begins with victims being lured to install a dropper app called TrustBastion, which uses scareware-style ads claiming that the target\u2019s device is infected. The malicious app is disguised as a security tool, claiming to detect threats such as scams, fraudulent SMS messages, phishing attempts, and malware.<\/p>\n

Immediately after installation, TrustBastion shows a mandatory update alert with visual elements that mimic Google Play.<\/p>\n

\"FakeFake Google Play page<\/strong>
Source: Bitdefender<\/p>\n

Instead of directly serving malware, the dropper contacts a server linked to trustbastion[.]com,\u00a0which returns a redirect to a Hugging Face dataset repository hosting the malicious APK. The final payload is downloaded from Hugging Face infrastructure and delivered via its content distribution network (CDN).<\/p>\n

To evade detection, the threat actor uses server-side polymorphism that generates new payload variants every 15 minutes,\u00a0Bitdefender says.\u00a0<\/p>\n

“At the time of investigation, the repository was approximately 29 days old and had accumulated more than 6,000 commits.”<\/p>\n

During analysis, the payload-serving repository was taken down, but the operation resurfaced under a new name, \u2018Premium Club,\u2019 which used new icons while retaining the same malicious code.<\/p>\n

The main payload, which lacks a…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Hugging Face abused to spread thousands of Android malware variants https:\/\/www.bleepingcomputer.com\/news\/security\/hugging-face-abused-to-spread-thousands-of-android-malware-variants\/ Publish Date: 2026-01-29 17:08:00…<\/p>\n","protected":false},"author":1,"featured_media":209721,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2024\/01\/12\/android-eyes.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[26,20,24,32,25,34],"class_list":["post-209720","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-ai","tag-artificial-intelligence","tag-cybersecurity","tag-malware","tag-phishing","tag-threat-actor"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209720"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=209720"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209720\/revisions"}],"predecessor-version":[{"id":209722,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/209720\/revisions\/209722"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/209721"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=209720"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=209720"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=209720"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}