Hugging Face Abused to Distribute Polymorphic Android RAT TrustBastion Malware Campaign Targeting Asia-Pacific Users

Executive Summary

A sophisticated and large-scale Android malware campaign has been identified leveraging the trusted Hugging Face platform to distribute thousands of polymorphic Android malware variants. This campaign, first reported by Bitdefender and widely covered by security media, exploits the public dataset hosting capabilities of Hugging Face to deliver malicious APK payloads. The primary malware, masquerading as a fake security application named TrustBastion, is a highly capable Remote Access Trojan (RAT) that abuses Android Accessibility Services to steal credentials, monitor user activity, and maintain persistent control over compromised devices. The operation demonstrates advanced evasion techniques, including rapid server-side polymorphism and infrastructure rebranding, and highlights the risks of abusing trusted AI and ML platforms for malware distribution. This report provides a detailed technical analysis, threat actor profile, exploitation tactics, victimology, and actionable mitigation strategies for organizations and individuals.

Threat Actor Profile

The threat actors behind this campaign have not been definitively attributed to any known Advanced Persistent Threat (APT) group. The operational characteristics, such as the focus on credential theft from financial applications and the use of polymorphic payloads, are consistent with financially motivated cybercriminals rather than state-sponsored actors. The campaign demonstrates a high degree of technical sophistication, including the automation of payload generation and the abuse of legitimate cloud infrastructure for malware hosting. The actors rapidly rebranded their operation from TrustBastion to Premium Club following initial takedowns, indicating agility and a strong understanding of the threat landscape. The infrastructure, including the use of trustbastion[.]com as a command-and-control (C2) and redirector, and the exploitation of Hugging Face datasets, suggests a well-resourced and organized group with experience in mobile malware distribution.

Technical Analysis of Malware/TTPs

The attack chain begins with social engineering tactics, typically scareware-style advertisements or pop-ups warning users of supposed infections. Victims are lured into downloading a fake security application, TrustBastion, which is distributed as an APK file outside the official Google Play ecosystem, thereby bypassing standard app store security controls. Upon installation, the app presents a counterfeit Google Play update dialog, coercing users to install an additional "update" for continued protection.

The initial dropper establishes contact with the C2 infrastructure at trustbastion[.]com, which then redirects the device to a malicious dataset repository hosted on Hugging Face. The final-stage payload, a polymorphic APK, is downloaded via the Hugging Face Content Delivery Network (CDN). The threat actors employ server-side polymorphism, generating new APK variants approximately every 15 minutes, resulting in over 6,000 unique payloads within a single month. This approach significantly complicates detection and signature-based defenses.

The malware’s core capabilities are centered around the abuse of Android Accessibility Services. Once granted these permissions, the RAT can overlay phishing screens atop legitimate applications, capture screen content and user input, block uninstallation attempts, and automate user interface interactions such as swipes and taps. Credential theft is achieved by presenting overlays mimicking popular financial services, including Alipay and WeChat, as well as the device lock screen. Persistent C2 communication enables real-time data exfiltration and remote command execution.

Following initial takedown efforts, the operation resurfaced under the name Premium Club, with cosmetic changes to icons and branding but retaining the same malicious codebase and TTPs. The campaign’s technical sophistication is further evidenced by its rapid adaptation to countermeasures and its exploitation of trusted platforms for malware delivery.

Exploitation in the Wild

The campaign has been observed primarily targeting Android users in the Asia-Pacific region, with a particular emphasis on harvesting credentials for regional payment platforms such as Alipay and WeChat. Distribution occurs exclusively via sideloading, as there is no evidence of the malware being present on Google Play. Infection vectors include direct download links disseminated through malicious advertisements, phishing messages, and compromised websites.

Once installed, the malware establishes persistence by leveraging Accessibility Services to prevent uninstallation and to maintain control over the device. The use of overlays enables effective phishing for sensitive information, including financial credentials and device PINs. The polymorphic nature of the payloads, combined with the use of reputable infrastructure like Hugging Face, allows the campaign to evade traditional detection mechanisms and to rapidly recover from takedown actions.

Victimology and Targeting

The primary victims of this campaign are individual Android users, particularly those in the Asia-Pacific region who utilize popular mobile payment services. The malware’s phishing overlays are tailored to mimic the interfaces of Alipay, WeChat, and the Android lock screen, indicating a clear focus on financial credential theft. There is no current evidence of targeting specific industries, enterprises, or government entities. The campaign’s distribution methods—relying on social engineering and sideloading—suggest a broad, opportunistic targeting strategy rather than highly targeted attacks.

Mitigation and Countermeasures

Organizations and individuals can reduce their exposure to this threat through a combination of technical controls and user education. Blocking access to known malicious infrastructure, including trustbastion[.]com and suspicious Hugging Face dataset URLs not associated with legitimate machine learning or AI activity, is essential. Mobile Device Management (MDM) solutions should be configured to prevent the sideloading of APKs on managed devices, thereby reducing the risk of infection from unauthorized sources.

User awareness is a critical component of defense. Users should be educated about the dangers of installing applications from outside Google Play and the risks associated with granting Accessibility Service permissions to untrusted apps. Security teams should monitor for applications requesting Accessibility Services without a clear, legitimate purpose and should implement alerting for such behavior.

Regularly updating mobile security solutions and enabling features such as Google Play Protect can provide an additional layer of defense, as these tools are capable of detecting and blocking known malware variants. Organizations should also maintain up-to-date blocklists of indicators of compromise (IOCs) and monitor network traffic for connections to suspicious domains and CDNs.

References

Bitdefender Labs: Hugging Face Repositories Used to Spread Android RAT (https://www.bitdefender.com/en-us/blog/hotforsecurity/hugging-face-android-rat-malware)

BleepingComputer: Hugging Face abused to spread thousands of Android malware variants (https://www.bleepingcomputer.com/news/security/hugging-face-abused-to-spread-thousands-of-android-malware-variants/)

CSO Online: Hugging Face infra abused to spread Android RAT in a large-scale malware campaign (https://www.csoonline.com/article/4124958/hugging-face-infra-abused-to-spread-android-rat-in-a-large-scale-malware-campaign.html)

MITRE ATT&CK for Mobile (https://attack.mitre.org/matrices/mobile/)

About Rescana

Rescana is a leader in Third-Party Risk Management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their digital supply chain. Our platform leverages advanced analytics and threat intelligence to deliver actionable insights, helping organizations stay ahead of emerging threats and maintain robust security postures. For more information or to discuss how Rescana can support your organization’s risk management strategy, we are happy to answer questions at ops@rescana.com.