Gigabud Android banking trojan weaponizes Work Profiles to bypass fraud detection and clone financial applications
The cybersecurity landscape has been shaken by the emergence of a sophisticated new technique employed by the notorious Gigabud Android banking trojan, which now leverages Android’s native Work Profile feature to facilitate high-stakes financial fraud. By weaponizing a customized fork of the open-source cloning utility Shelter, known as Vwork, operators associated with the threat actor GoldFactory have effectively created an isolated, invisible environment to execute illicit transactions. This development represents a significant evolution in mobile malware, specifically designed to decouple suspicious activity from traditional security alerts, thereby granting fraudsters a clean slate from which to drain victim accounts.
Research published on September 9 by cybersecurity firm Group-IB provides a comprehensive breakdown of this infection chain. The findings suggest that GoldFactory—a group previously linked to the high-profile GoldPickaxe trojan—has moved beyond simple credential harvesting. By integrating Vwork into the Gigabud malware, attackers can now replicate a victim’s legitimate banking application into a secondary, isolated "Work Profile." Because Android treats Work Profiles as distinct environments, security solutions running on the primary user profile are often blind to activities occurring within the secondary container. This tactical isolation ensures that when a fraudulent transaction is initiated, the bank perceives it as originating from a new, clean device, circumventing device-fingerprinting security measures that banks rely on to flag anomalies.
A Chronology of the Gigabud Evolution
Gigabud has been a persistent threat in the mobile ecosystem since its initial discovery in 2022. Historically, the malware functioned as a traditional overlay trojan, using phishing campaigns—often disguised as tax authorities, airline portals, or government service applications—to trick users into granting accessibility permissions. These permissions allowed the malware to record keystrokes, intercept SMS messages, and draw fake login screens over legitimate banking apps.
The transition to the Vwork-enabled model marks a pivot toward more surgical, long-term persistence. Between February and July 2026, researchers observed a concentrated campaign in Indonesia that served as the testing ground for this new methodology. During this six-month window, investigators tracked approximately 1,469 compromised devices and 1,281 potentially compromised logins. The financial toll of these operations in Indonesia alone is estimated at approximately $960,939, a figure that analysts believe is only a fraction of the total global impact, given that the malware’s reach extends to at least 11 countries, including Brazil, Thailand, Mexico, Turkey, Colombia, and Egypt.
The Mechanics of Vwork and Profile Isolation
The core of this new threat lies in the subversion of the Android Work Profile feature, which is natively designed to separate personal and professional data. In a standard enterprise scenario, this feature provides a secure sandbox for corporate applications. However, GoldFactory’s Vwork fork strips away the user-facing controls typical of the original Shelter app, turning the cloning functionality into a headless service that can be invoked programmatically by the Gigabud malware.
Once the malware gains administrative control via accessibility permissions, it executes a multi-stage process. First, it communicates with an external authorization server to retrieve a token necessary for the cloning process. Next, it silently provisions a new Work Profile on the device. It then clones the target banking application into this hidden environment. Because the app is "fresh" within the Work Profile, it lacks the history or cached credentials of the original, forcing the user to re-authenticate. The malware provides a fake login overlay to capture these credentials, while simultaneously using an invisible screen-overlay to capture the device’s lock screen PIN.
To the financial institution’s fraud detection engine, the entire sequence appears legitimate. Since the banking app is running within a separate profile, the "device ID" may appear different, or it may appear as a new installation on a clean device. By the time the transaction is initiated, the attackers have effectively bypassed the behavioral biometrics and device-binding security protocols that are intended to protect against automated fraud.
Broader Implications for Mobile Security
The implications of this development are severe for the financial sector and the broader mobile security industry. For years, banks have invested heavily in "device fingerprinting"—the practice of analyzing device metadata to confirm that a user is logging in from a known, secure handset. By cloning the app into a Work Profile, Gigabud exploits a blind spot in the Android OS’s architecture, where one profile cannot inherently query the security state or the presence of malicious apps in another.
This creates a "separation problem" for security vendors. If a security app is installed in the personal profile, it has no authority to scan the Work Profile unless it is specifically provisioned as an enterprise device management (MDM) solution. Most individual consumers do not employ enterprise-grade security on their personal phones, leaving them vulnerable to this architectural manipulation.
The operational risk is further compounded by the stealthy nature of the fraud. During the final stages of a transaction, the malware displays a black screen to the victim, preventing them from observing the interaction between the app and the banking server. By the time the victim regains control of their device, the transaction has already been authorized and the session cleared.
Behavioral Indicators and Risk Mitigation
Despite the sophistication of the attack, Group-IB has identified specific behavioral signals that could assist banks and security teams in detecting these compromised sessions. These indicators include:
- Unexpected Work Profile Creation: The sudden appearance of a Work Profile on a personal device that was not explicitly configured by the user is a primary red flag.
- App Duplication: The existence of multiple instances of the same banking application across different user profiles on a single device.
- Environment Anomalies: An isolated environment that contains a banking app but is otherwise devoid of typical "work" applications like email, calendars, or messaging clients.
- Accessibility Misuse: Accessibility permissions being granted to an application that does not have a legitimate functional reason to require them.
Financial institutions are being urged to implement more robust device-binding techniques that look beyond simple device IDs. Binding a user’s account to a specific hardware-backed security key or a secure enclave within the device’s processor can prevent unauthorized cloning from successfully bypassing authentication. Furthermore, banks should consider implementing "app-aware" security checks that monitor for the presence of multiple profiles and flag sessions that originate from within secondary environments.
The Future of Mobile Banking Fraud
The shift toward utilizing native OS features like Work Profiles indicates that mobile malware developers are moving away from brute-force exploits and toward "living-off-the-land" techniques. By utilizing legitimate, built-in features to carry out malicious actions, attackers make it increasingly difficult for signature-based antivirus solutions to differentiate between benign user activity and sophisticated fraud.
The GoldFactory group, through its continued development of tools like Gigabud and Vwork, demonstrates a high level of technical maturity and a deep understanding of the Android platform’s limitations. As mobile banking continues to expand in emerging markets, the frequency of these attacks is likely to increase. Users are reminded that the most effective defense remains the consistent use of official app stores, the avoidance of sideloading applications from untrusted sources, and extreme caution regarding accessibility requests from unknown applications.
As the industry grapples with this new paradigm of "profile-isolated fraud," the pressure is mounting on mobile OS developers to introduce more stringent controls on the programmatic creation of Work Profiles. Until such systemic changes are implemented, the security burden will continue to rest heavily on the shoulders of financial institutions, who must now evolve their fraud detection models to account for the hidden, secondary environments that modern trojans like Gigabud so effectively exploit. The case of Gigabud and Vwork serves as a stark reminder that in the ongoing arms race between developers and cybercriminals, the architecture of the operating system itself is becoming the primary battleground.
Related posts:
