Android RAT Campaign Uses Hugging Face to Deliver Polymorphic Payloads

Jan 29, 2026 · Original article ↗

Summary

Bitdefender researchers detail an Android RAT campaign that uses deceptive apps and Hugging Face to deliver frequently rebuilt payloads. The malware abuses Accessibility Services to spy on users, steal credentials, and send data to its operators.

Key points

The campaign starts with deceptive apps, including TrustBastion, that prompt users to install a malicious update.
A dropper retrieves a redirect from trustbastion[.]com and downloads the second-stage APK from Hugging Face.
The Hugging Face repository had more than 6,000 commits in about 29 days, with new payloads generated roughly every 15 minutes to evade hash-based detection.
The RAT abuses Accessibility Services and requests screen-recording, screen-casting, and overlay permissions to monitor and manipulate device activity.
It captures screen content and authentication data, including through fake financial-service interfaces, and sends stolen information to its C2 server.
A later app called Premium Club used the same underlying code; Bitdefender reported that Hugging Face took down the datasets containing malware.

Article Details

Attack Vectors: A deceptive Android dropper named TrustBastion prompts users to install an update, then retrieves a second-stage APK through a redirect to a Hugging Face dataset.
The payload impersonates a phone-security feature and persuades users to enable Accessibility Services, screen recording, screen casting, and overlay permissions.
Fraudulent authentication interfaces impersonate financial and payment services to capture credentials and lock-screen information.
The RAT captures screen content and user activity and sends the data to command-and-control infrastructure.
New APK variants were reportedly generated roughly every 15 minutes with minor changes intended to evade hash-based detection.
Defensive Notes: Assess app behavior, permissions, and communication patterns rather than relying only on file hashes.
Treat requests to enable Accessibility Services or other powerful permissions under the guise of a system or security feature with caution.
Bitdefender reports that Hugging Face took down the datasets containing the malware after being contacted.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`au-club[.]top`	Domain reported as C2 infrastructure for the second wave.
DOMAIN	`trustbastion[.]com`	Domain used by the campaign for the dropper's encrypted endpoint and linked to its C2 infrastructure.
IPV4	`108[.]187[.]7[.]133`	IP address reported as C2 infrastructure for the second wave.
IPV4	`154[.]198[.]48[.]57`	C2 server used to receive commands, transmit stolen data, and deliver configuration.
MD5	`15bdc66aca9fb7290165d460e6a993a9`	Dropper hash listed among the campaign's indicators of compromise.
MD5	`b716a8a742fec3084b0f497abbfecfc0`	Dropper hash listed among the campaign's indicators of compromise.
MD5	`d184d705189e42b54c6243a55d6c9502`	Dropper hash listed among the campaign's indicators of compromise.
MD5	`d8b0fd515d860be2969cf441ea3b620d`	Dropper hash listed among the campaign's indicators of compromise.
MD5	`fc874c42ea76dd5f867649cbdf81e39b`	Dropper hash listed as a second-wave indicator of compromise.
URL	`hxxps[:]//huggingface[.]co/datasets/xcvqsccm/sfxyt851/resolve/main/b[.]apk?download=true`	Specific Hugging Face dataset URL from which the campaign's final APK was downloaded.
URL	`hxxps[:]//www[.]trustbastion[.]com/xiazz[.]html`	Observed request to the campaign endpoint that returned a redirect link to the malicious APK.