Fake 'Antivirus' App Spreads Android Malware, Steals Banking Credentials - TechRepublic

"According to a report by Fox News, the ruse centers on an app called TrustBastion, which purports to be an Android security solution offering virus protection, phishing defense, and malware blocking. But it's all a clever front. Cybersecurity experts found this app hidden in public repositories on Hugging Face, a well-known developer hub for artificial intelligence and machine learning tools."

"Once users install the fake app, they're hit with a scare tactic: a prompt claiming their phone is infected and urging them to "update" the app. That update doesn't fix anything. Instead, it activates the malware payload, turning your phone into a gateway for spying and data theft. In other words, the very action meant to "clean" your device is what actually compromises it."

"In other words, the very action meant to "clean" your device is what actually compromises it. From there, the malware can quietly take screenshots, steal your lock-screen PIN, and display fake login screens for banking services that mimic real ones. Any credentials you enter could be sent straight to the attackers. This is the classic "scareware" strategy at work - triggering urgency to trick you into giving the malware the permissions it needs."

The TrustBastion app poses as an Android antivirus offering virus protection, phishing defense, and malware blocking while actually carrying a malicious payload. The app was placed in public repositories on Hugging Face, exploiting the platform's open, developer-focused environment to distribute downloadable files that may appear legitimate. After installation, the app prompts a fake "update" that activates spyware, turning devices into gateways for spying and data theft. The malware can take screenshots, capture lock-screen PINs, and overlay convincing fake banking login screens to harvest credentials. Scareware-style alerts push users to grant permissions that enable these attacks.

Read at TechRepublic