The Hugging Face infrastructure has been abused for the delivery of an Android remote access trojan (RAT), Bitdefender reports.
The attack chain starts with an ad or a prompt to download and install a security application claiming to provide multiple useful features.
The application, called TrustBastion, acts as a dropper and immediately after launch prompts the user to fetch an update, displaying legitimate-looking Google Play and Android system update dialogs.
Once the user agrees, the dropper connects to an encrypted endpoint hosted at trustbastion[.]com, which serves an HTML page that points to a Hugging Face repository, and then downloads a malicious payload from the online platform’s datasets.
According to Bitdefender, the Hugging Face repository used in the attack was roughly a month-old when taken offline and had over 6,000 commits. New payloads were being generated roughly every 15 minutes, the cybersecurity firm says.
“The repository eventually went offline, but only for the entire operation to move to another link, with the project using different icons and some minor adjustments. The code remained the same,” Bitdefender explains.
After installation, the malicious payload requested broad permissions, pretending to be a security feature, and guided the user to enable Accessibility Services to monitor their actions.
It also requested permissions to record the screen, perform screen casting, and display overlays, enabling it to observe, capture, and modify on-screen content in real time.
Once permissions are enabled, the malware can control infected devices and exfiltrate screen content to the command-and-control (C&C) server.
“The malware also displays fraudulent authentication interfaces designed to harvest sensitive credentials. It tries to impersonate popular financial and payment services, including Alipay and WeChat,” Bitdefender says.
Additionally, the malware could capture lock screen information and authentication actions, and was seen maintaining persistent communication with the C&C and downloading webviews to mimic legitimate functionality.
“This infrastructure is used to receive commands, transmit stolen data and deliver updated configuration information to infected devices. The same infrastructure also facilitates payload redirection by serving Hugging Face download links to the initial dropper,” Bitdefender says.
Soon after the repository hosting TrustBastion disappeared at the end of December, another repository emerged, hosting Premium Club, a seemingly different app that has the same underlying code. Hugging Face took down the datasets serving the malware, Bitdefender says.
Related: Kimwolf Android Botnet Grows Through Residential Proxy Networks
Related: New $150 Cellik RAT Grants Android Control, Trojanizes Google Play Apps
Related: New Albiriox Android Malware Developed by Russian Cybercriminals
Related: Landfall Android Spyware Targeted Samsung Phones via Zero-Day
