A fake security app called TrustBastion is being used to drop remote‑access malware hosted on Hugging Face, with attackers generating thousands of Android package variants to evade detection, ...