Hackers abused Hugging Face to spread Android malware through a fake antivirus app. Here is how it works and how to protect your phone.