Attackers Abuse Hugging Face Hosting to Deliver Android RAT

A sophisticated Android Remote Access Trojan (RAT) campaign leveraging the Hugging Face AI platform for payload distribution.

The operation combines server-side polymorphism with the abuse of legitimate infrastructure to bypass reputation-based filtering, deploying new malware samples approximately every 15 minutes to evade detection.

Infection Chain and Dropper Mechanics

The infection begins with a dropper application, initially identified as “TrustBastion” and later resurfacing as “Premium Club.” These applications are distributed via malvertising, masquerading as security tools or utility apps

Upon manual installation, the dropper exhibits benign behavior but immediately triggers a deceptive update prompt.

This dialog mimics legitimate Google Play or Android system update interfaces to coerce the user into authorizing the download of the second-stage payload.

Unlike typical campaigns that host payloads on malicious domains, this campaign retrieves the malicious APK directly from Hugging Face repositories.

The campaign’s defining characteristic is its abuse of Hugging Face, a platform widely trusted in the developer community for hosting machine learning models.

Traffic to huggingface.co Typically, it bypasses network blocklists due to the domain’s high reputation.

Network analysis reveals that the dropper contacts a command-and-control (C2) endpoint (e.g., trustbastion[.]com) which returns an HTML page containing a redirect link.

This link points to a specific Hugging Face repository hosting the payload.

To maintain persistence and evade hash-based detection mechanisms, the attackers employ server-side polymorphism.

The investigation found the repository generating roughly 6,000 commits over 29 days, resulting in a unique payload hash every 15 minutes.

While the cryptographic hash changes, the underlying malicious code structure remains consistent.

RAT Capabilities and Accessibility Abuse

Once installed, the payload requests access to Accessibility Services under the guise of a “Phone Security” feature, as reported by Bitdefender.

Granting this permission allows the RAT to bypass the Android security model and perform unauthorized actions, including:

• Screen Recording and Casting: Capturing real-time user activity.
• Overlay Attacks: Displaying fraudulent login interfaces over legitimate financial apps (specifically targeting Alipay and WeChat) to harvest credentials.
• Persistent Control: Establishing a connection to the C2 server to exfiltrate device data and lock-screen patterns.

The malware maintains persistent visibility via keep-alive connections to a centralized C2 infrastructure.

The primary endpoint identified during analysis was 154.198.48.57 over port 5000. This server coordinates payload delivery, receives exfiltrated data, and manages the redirection logic that points victims to the active Hugging Face repository.

Indicators of Compromise (IOCs)

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.