Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 9, 2026
- Last mentionedSep 10, 2026
Timeline
3 articles · newest firstHackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
58
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
60
Appears with
- Shelterproduct · 3
- Group-IBvendor · 3
- GoldFactorythreat actor · 3
- Gigabudmalware · 3
- Androidproduct · 2
- Gigabudproduct · 2
- Vworkproduct · 2
- banks in Indonesia and other countriesvictim · 1
- Googlevendor · 1
- Googleorganization · 1
- GoldFactoryorganization · 1
- Group-IBorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.