Android malware creates a hidden copy of your banking app
Group-IB found the Gigabud Android banking trojan clones banking apps into a hidden work profile to conduct fraud undetected.
Group-IB researchers found the Gigabud Android banking trojan installs Vwork, a trojanized version of the open-source Shelter app, to create a separate Android work profile and clone the victim's banking app into it. The operator then performs fraudulent transactions from the cloned app, separating risky activity from malware detections in the personal profile and potentially bypassing bank-side anti-fraud checks. Victims are lured into sideloading fake airline, tax, or government apps via phishing sites and messages, then grant Accessibility, overlay, and battery-optimization permissions that enable remote control and credential-theft overlays. Malwarebytes detects Gigabud components under multiple Android.Trojan.Banker signatures.
- Gigabud installs Vwork, a modified copy of the open-source Shelter tool, to create a hidden work profile.
- Fraudulent transactions run from the cloned banking app may not correlate with malware alerts in the personal profile.
- Victims are lured into sideloading fake airline, tax, or government apps that request Accessibility and overlay permissions.
- Fake banking login overlays steal banking credentials and the device PIN.
- A second instance of a banking app in a work profile is a strong compromise indicator.
- Vendors
- Malwarebytes
- Malware
- Gigabud
- Organizations
- Group-IBMalwarebytes
From the original article
3 min read at malwarebytes.com
The Gigabud banking Trojan can clone a banking app into a separate work profile on an Android device to help hide fraudulent transactions.
By @MetallicaMVP · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.