Threat actors are abusing Hugging Face and ClawHub to distribute malware by injecting indirect prompts into malicious files.