Threats · 48 days ago
Group-IB said GoldFactory’s Gigabud campaign is now using Android Work Profiles in the wild in Indonesia, turning a legitimate enterprise feature into a hiding place for cloned banking apps. The firm validated the full chain on infected devices and tied the setup to Vwork, a helper app that creates the separate profile and drops the fake banking app inside it.
The split matters because the bank’s malware checks look in the personal app space, while the cloned app runs in the work profile. That lets the trojan stay out of view of app-level fraud controls, so a payment can be made from the isolated copy without triggering the same alert path as the original phone.
For financial institutions that trust device-risk or mobile-malware signals, the exposure is at the profile boundary Android is built to preserve. If a banking model assumes one scan sees the whole device, this campaign shows how a legitimate container can break that assumption without touching Android itself.
3 sources covering this story
Indonesia Hit by Android Banking App-Cloning Campaign
The GoldFactory threat group exploits the Android Work Profile feature to deliver the Gigabud Trojan, while Mantax Otax spreads separately.
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Gigabud uses Vwork to create Android work profiles that hide the trojan from banking app malware checks, with the chain confirmed in Indonesia.
Gigabud Uses Android App Cloning to Evade Fraud Detection
Gigabud clones banking apps into a work profile to break the link between malware alerts and fraud
Part of the PlainSec briefing for 2026-09-11