Android malware creates a hidden copy of your banking app
Group-IB found the Gigabud Android banking trojan clones banking apps into a hidden work profile to conduct fraud undetected.
45
Malware
Gigabud
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenSep 9, 2026
- Last mentionedSep 11, 2026
Timeline
7 articles · newest firstIndonesia Hit by Android Banking App-Cloning Campaign
GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.
45
Google Play Early Access Abused to Push Thousands of Deceptive Android Apps
Bitdefender found abuse of Google Play's review-free Early Access program to push thousands of deceptive casino and reward apps promoted with AI deepfake ads.
50
Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
Gigabud Uses Android App Cloning to Evade Fraud Detection
Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.
52
Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
58
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
60
Appears with
- GoldFactorythreat actor · 6
- Shelterproduct · 5
- Group-IBvendor · 4
- Vworkproduct · 4
- Androidproduct · 4
- Group-IBorganization · 4
- Vworkmalware · 3
- Googlevendor · 2
- Gigabudproduct · 2
- StreamRatmalware · 1
- GoldFactoryorganization · 1
- Googleorganization · 1
- Malwarebytesvendor · 1
- Mantaxmalware · 1
- banks in Indonesia and other countriesvictim · 1
- Malwarebytesorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.