GoldFactory hides Gigabud inside Android Work Profiles
Group-IB said GoldFactory’s Gigabud campaign is now using Android Work Profiles in the wild in Indonesia, turning a legitimate enterprise feature into a hiding place for cloned banking apps. The firm validated the full chain on infected devices and tied the setup to Vwork, a helper app that creates the separate profile and drops the fake banking app inside it.
The split matters because the bank’s malware checks look in the personal app space, while the cloned app runs in the work profile. That lets the trojan stay out of view of app-level fraud controls, so a payment can be made from the isolated copy without triggering the same alert path as the original phone.
For financial institutions that trust device-risk or mobile-malware signals, the exposure is at the profile boundary Android is built to preserve. If a banking model assumes one scan sees the whole device, this campaign shows how a legitimate container can break that assumption without touching Android itself.