Hackers have abused the Hugging Face infrastructure to host a malicious payload and infect Android users with a remote access trojan.