Bitdefender has identified a new Android malware campaign that used the Hugging Face public-facing infrastructure to host its malicious files.