Android malware creates a hidden copy of your banking app
Group-IB found the Gigabud Android banking trojan clones banking apps into a hidden work profile to conduct fraud undetected.
45
Product
Shelter
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenSep 9, 2026
- Last mentionedSep 11, 2026
Timeline
5 articles · newest firstGigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
60
Gigabud Uses Android App Cloning to Evade Fraud Detection
Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.
52
Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.
58
GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
60
Appears with
- Gigabudmalware · 5
- Vworkproduct · 4
- Group-IBvendor · 4
- GoldFactorythreat actor · 4
- Vworkmalware · 3
- Group-IBorganization · 3
- Androidproduct · 3
- Gigabudproduct · 2
- Googlevendor · 1
- GoldFactoryorganization · 1
- Googleorganization · 1
- Malwarebytesvendor · 1
- Malwarebytesorganization · 1
- banks in Indonesia and other countriesvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.