ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Product

Vwork

4 mentions in 7 days · 4 in 30 days · 4 total · first seen · last

Search everything

Timeline

Android malware creates a hidden copy of your banking app

Group-IB found the Gigabud Android banking trojan clones banking apps into a hidden work profile to conduct fraud undetected.

Group-IB researchers found the Gigabud Android banking trojan installs Vwork, a trojanized version of the open-source Shelter app, to create a separate Android work profile and clone the victim's banking app into it. The operator then performs fraudulent transactions from the cloned app, separating risky activity from malware detections in the personal profile and potentially bypassing bank-side anti-fraud checks. Victims are lured into sideloading fake airline, tax, or government apps via phishing sites and messages, then grant Accessibility, overlay, and battery-optimization permissions that enable remote control and credential-theft overlays. Malwarebytes detects Gigabud components under multiple Android.Trojan.Banker signatures.

Malwarebytes Labs · 4d agoMalware 6 sources

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.

Group-IB says Gigabud installs a helper app called Vwork, derived from the open-source Shelter tool, which creates an Android work profile and drops a tampered banking app inside it, hiding the trojan from banking apps' malware scans. Gigabud, active since 2022 and linked by Group-IB to the GoldFactory group, abuses Accessibility access and overlay screens to steal credentials and run fraudulent payments while a black screen conceals the operator's actions. Group-IB confirmed the full attack chain on infected devices in Indonesia, counting about 1,469 compromised devices and estimated losses of roughly $960,000 between February and July 2026. Vwork-compatible Gigabud samples have been found targeting 11 countries including Brazil, Mexico, Indonesia, Thailand, and Türkiye, though only the Indonesian chain is confirmed.

The Hacker Newsupdated · 4d agofirst · 5d agoMalware in the wild 6 sources1

Gigabud Uses Android App Cloning to Evade Fraud Detection

Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.

Group-IB found Gigabud now ships dedicated code to work with Vwork, a weaponized fork of the open-source Android cloning app Shelter it attributes to GoldFactory, exposing cloning functions so any installed app can call them. After installing via phishing sites and messengers posing as airline, tax and government apps, operators request accessibility and overlay permissions, then clone the victim's banking app into a new work profile where it is invisible to signature-based detection in the personal profile. Fake login screens and overlays capture credentials while cloned-app transactions appear to banks as coming from an unrecognized, malware-free device. Between February and July 2026 in Indonesia, Group-IB observed about 1,469 compromised devices, 1,281 potentially compromised logins and estimated losses of roughly $960,939, with Vwork-enabled samples targeting 11 countries including Brazil, Mexico, Egypt and Thailand.

Infosecurity Magazineupdated · 4d agofirst · 6d agoMalware in the wild 6 sources

Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection

GoldFactory-linked Gigabud and Vwork malware clone banking apps into hidden Android work profiles to evade fraud detection across 11+ countries.

Group-IB links Vwork, a modified version of the open-source Shelter app cloner, to the GoldFactory group and its Gigabud Android RAT, which clones victim banking apps into an isolated work profile so fraud sessions look clean to banks. From February through July 2026, researchers observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses near $960,939. Targets span Brazil, Colombia, Egypt, Indonesia, Mexico, Morocco, the Philippines, Thailand, Türkiye, Laos, and a GCC state; delivery uses fake airline, tax, government, and banking apps pushed via phishing sites, messaging apps, and social media.

Cyber Security Newsupdated · 4d agofirst · 6d agoMalware in the wild 6 sources

Appears with

malware Gigabud 4product Shelter 4organization Group-IB 3vendor Group-IB 3threat actor GoldFactory 3product Android 2malware Vwork 2product Gigabud 2vendor Malwarebytes 1organization GoldFactory 1organization Google 1organization Malwarebytes 1vendor Google 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.