Hugging Face Misused to Distribute Thousands of Android Malware Variants

The recent malware campaign discovered by Bitdefender has leveraged the Hugging Face platform to distribute thousands of Android malware variants. The attack initiates with victims downloading a dropper app named TrustBastion, which falsely claims to be a security tool that detects threats. This app uses scare tactics to convince users to install it, displaying alerts that mimic legitimate Google Play updates.

Once installed, TrustBastion contacts a server linked to trustbastion[.]com, which redirects to a Hugging Face dataset repository hosting the malicious APK. The malware employs server-side polymorphism, generating new payload variants every 15 minutes to evade detection. At the time of investigation, the repository had been active for approximately 29 days and had accumulated over 6,000 commits.

Although the original payload-serving repository was taken down, the operation quickly resurfaced under a new name, ‘Premium Club,’ maintaining the same malicious code while using different icons. The malware itself is a remote access tool that exploits Android’s Accessibility Services, allowing it to perform various malicious activities such as capturing screenshots and blocking uninstallation attempts.

Bitdefender has reported that the malware monitors user activity, exfiltrating sensitive information to its operators. It also displays fake login interfaces for financial services like Alipay and WeChat to steal user credentials. The malware maintains a constant connection to its command-and-control server, which facilitates data theft and command execution.

Bitdefender notified Hugging Face about the malicious repository, leading to its removal. Researchers have also published indicators of compromise related to the dropper app, the network, and the malicious packages involved in this campaign.

Understanding the Risks

This incident underscores the risks associated with downloading apps from unverified sources, even from platforms considered trusted. Users should be cautious about permissions requested by apps and avoid third-party app stores. The TrustBastion app’s ability to disguise itself as a security tool exemplifies how attackers can exploit user trust.

As this campaign demonstrates, malware can evolve rapidly, employing techniques like polymorphism to stay ahead of detection efforts. Users and organizations must remain vigilant and proactive in their cybersecurity practices, regularly reviewing app permissions and monitoring for unusual activity.