Fake antivirus app TrustBastion uses Hugging Face to deliver Android malware that captures screenshots, steals PINs and shows fake login screens, according to Bitdefender.