Case hugging-face-android-rat-cdnAI supply chainWorldwide
Hugging Face datasets abused to serve polymorphic Android RAT payloads every 15 minutes
Bitdefender found a scareware dropper app, TrustBastion, fetching an accessibility-abusing Android trojan from a Hugging Face dataset repository that regenerated its payload every 15 minutes and had over 6,000 commits in 29 days.
HighAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jan 29, 2026
- Location
- Worldwide
- Target
- Android users; Hugging Face CDN
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Bitdefender found a scareware dropper app, TrustBastion, fetching an accessibility-abusing Android trojan from a Hugging Face dataset repository that regenerated its payload every 15 minutes and had over 6,000 commits in 29 days.
Impact: Thousands of Android RAT variants distributed; victims risk screen capture, overlay phishing of Alipay and WeChat, PIN theft and blocked uninstallation
Who triggered it
Actor: Unknown
Attribution: Unattributed; fake Alipay and WeChat login overlays suggest targeting of Chinese-speaking users
Motive: Financial fraud via credential overlays, PIN theft and device control
How it happened
Attack vector: Dropper app sideloaded via scareware ads redirects through an intermediary server to APKs hosted on Hugging Face's CDN
Root cause: Trusted AI model and dataset hosting with clean reputation used as a malware distribution channel; server-side polymorphism defeats hash detection
Timeline
- Bitdefender analyses a 29-day-old Hugging Face repository with more than 6,000 commits of malware variants
- Hugging Face removes the datasets after Bitdefender's report; campaign reappears as 'Premium Club'
- Further coverage notes the operation re-emerged with the same code
Response
Hugging Face removed the malicious datasets; Google said Play Protect blocks the apps and none were on Google Play
Current status: Ongoing
Sources (open in a new tab)
- BleepingComputer bleepingcomputer.com
- Netzwoche netzwoche.ch
Cite this case
Hugging Face datasets abused to serve polymorphic Android RAT payloads every 15 minutes. AI Threat Watch, case hugging-face-android-rat-cdn, Jan 29, 2026. https://aithreat.io/cases/hugging-face-android-rat-cdn/
Permanent link: https://aithreat.io/cases/hugging-face-android-rat-cdn/