Indonesia Hit by Android Banking App-Cloning Campaign
GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.
45
Threat actor
GoldFactory
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 24, 2026
- Last mentionedSep 11, 2026
Timeline
7 articles · newest firstGoogle Play Early Access Abused to Push Thousands of Deceptive Android Apps
Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.
50
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
Gigabud Uses Android App Cloning to Evade Fraud Detection
Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.
52
Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
58
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
60
ToxicPanda 2.0 and GoldDigger Expand Android Banking Attacks with On
Zimperium and IBM Trusteer report expanded ToxicPanda 2.0 and GoldDigger Android banking trojan campaigns now targeting 349 financial institutions across 16 countries.
70
Appears with
- Gigabudmalware · 6
- Group-IBvendor · 5
- Group-IBorganization · 4
- Shelterproduct · 4
- Vworkproduct · 3
- Androidproduct · 3
- Vworkmalware · 3
- Gigabudproduct · 2
- Googlevendor · 2
- Bitdefendervendor · 1
- Zimperiumorganization · 1
- ToxicPandaproduct · 1
- Mantax Otaxmalware · 1
- Indonesian Android banking customersvictim · 1
- Android Work Profileproduct · 1
- StreamRatmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.