GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks
Group-IB says GoldFactory's Gigabud Android trojan uses Vwork, a weaponized Shelter fork, to clone banking apps into isolated Work Profiles and evade bank-side detection.
Group-IB's 'Hook for Gold' investigation found GoldFactory ships Vwork, a modified fork of the open-source Shelter app, alongside its Gigabud Android banking trojan, active since 2022. Vwork abuses Android Work Profile provisioning to clone banking apps into an isolated environment, weakening the link between detected malware signals and fraudulent transactions. Gigabud has targeted victims in Southeast Asia, Latin America, the Middle East, Africa, and beyond via fake airline, tax, and government apps requesting Accessibility and overlay permissions. In Indonesia, telemetry recorded about 1,469 compromised devices and roughly $960,939 in estimated losses between February and July 2026.
- Vwork, a weaponized Shelter fork, clones banking apps into isolated Android Work Profiles
- Gigabud abuses Accessibility and overlays to read screens, capture credentials, and automate taps
- C2 commands initVwa, cloneApp, and uploadCloneApps manage the virtualized environment
- Observed across Brazil, Indonesia, Egypt, Mexico, Philippines, Thailand, and other countries
- Indonesia: about 1,469 devices compromised, roughly $960,939 estimated losses Feb-Jul 2026
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| sha256 | 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3 | 088a3260e54ad1728a3eadc0b509386cae200993b33673b343c Gigabud 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3 Note: IP addresses and domains are intentionally defanged ( |
| sha256 | 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf | 6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc Gigabud 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud 9ca27df7938f12794bab0847434482955ca9adea714a34afd31 |
| sha256 | 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c | 2794bab0847434482955ca9adea714a34afd315c7a7be522611 Gigabud 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c Gigabud 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae |
| sha256 | 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc | cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae Gigabud 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc Gigabud 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f |
| sha256 | 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611 | 4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf Gigabud 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611 Gigabud 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae2009 |
| sha256 | ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae | 0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 Gigabud ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae Gigabud 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527 |
| sha256 | b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 | horized transfers. IOCs Malware Family SHA-256 Hash Gigabud b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 Gigabud ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960dde |
Full article729 words · extracted from gbhackers.com · click to collapse
GoldFactory has expanded the evasion capabilities of its Gigabud Android banking trojan by deploying Vwork, a weaponized fork of the open-source Shelter application.
The companion tool abuses Android Work Profile isolation to clone banking apps into a separate managed environment, weakening the link between malware signals detected in a victim’s personal profile and fraudulent activity performed elsewhere on the same device.
The recurring sequence, combined with Gigabud samples containing explicit Vwork interaction logic, indicates that Vwork is an operational component of GoldFactory’s mobile-fraud toolkit rather than an unrelated application.
Gigabud, active since 2022, is an Android remote-access trojan attributed by Group-IB to GoldFactory. It has been used against victims across Southeast Asia, South Asia, the Middle East, Africa, and Latin America.
Operators commonly use phishing sites, messaging platforms, social-media lures, and fraudulent calls to persuade targets to sideload APKs impersonating airlines, tax agencies, or government services.
Once installed, Gigabud requests high-risk permissions, including Accessibility access, overlay privileges, and battery-optimization exemptions.
Accessibility is particularly significant because it can enable attackers to read on-screen content, capture credentials through overlays, automate taps and gestures, unlock screens, and remotely operate the compromised handset.
GoldFactory’s broader campaigns have also used convincing fake Google Play pages and government-themed social-engineering lures to deliver malware.
Group-IB said in a report shared with GBhackers, identified Vwork during its “Hook for Gold” investigation after repeatedly observing the application installed shortly after Gigabud infections alongside tampered banking apps.
Gigabud Banking Malware
Vwork changes the fraud model by turning Android’s enterprise-oriented Work Profile feature into a device-level evasion layer.
Shelter, the upstream open-source project, is designed to let device owners manually create isolated app spaces.
Vwork retains that architectural foundation but exposes cloning and app-management functions through APIs available to other applications.
In effect, Gigabud can command Vwork to provision a profile, clone a targeted package, enumerate cloned applications, and launch applications inside the isolated environment.
The modifications are operationally important. Group-IB found that Vwork removes Shelter’s restrictions around cross-profile interaction, alters file-sharing behavior, supports sideloading, limits Accessibility service use in the provisioned profile, and hides its launcher icon.
Its setup flow is also reduced to a simplified activation prompt, while much of the configuration is delegated to an external controller rather than retained in the user interface.
Gigabud samples built to work with Vwork declare the package name net.yy.vwork and include new command-and-control functions such as initVwa, cloneApp, and uploadCloneApps.
The malware also prefixes app identifiers with vwa- in C2 communications when handling apps in the virtualized environment.
The cloning operation relies on external authorization, with Gigabud obtaining a token from its infrastructure before directing Vwork to clone a selected target package.
This separation is designed to undermine security telemetry. A bank may identify malware or suspicious Accessibility behavior in the personal profile, but subsequent transactions conducted through a newly created work-profile instance can appear to originate from a different, cleaner app environment.
In one confirmed Indonesian case, attackers cloned a fake version of a legitimate bank application after deploying Gigabud and Vwork.
Group-IB observed Gigabud variants compatible with Vwork targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and an unnamed GCC state.
In Indonesia, telemetry recorded approximately 1,469 compromised devices and 1,281 potentially compromised logins between February and July 2026, with estimated observed losses of about $960,939.
For financial institutions, detection should focus on behavior rather than a single malware signature: unexpected work-profile creation on consumer devices, duplicate banking-app installations across profiles, unusual sideloading sequences, Accessibility abuse, and a sparse work-profile environment immediately preceding high-risk transactions.
Correlating these signals can expose the profile-isolation technique before attackers complete unauthorized transfers.
IOCs
| Malware Family | SHA-256 Hash |
|---|---|
| Gigabud | b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501 |
| Gigabud | ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae |
| Gigabud | 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc |
| Gigabud | 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf |
| Gigabud | 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611 |
| Gigabud | 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c |
| Gigabud | 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3 |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Mayura Kathirhttps://gbhackers.com/
Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.
Text extracted automatically; images, tables and formatting may be missing. Original: https://gbhackers.com/gigabud-banking-malware/