Indonesia Hit by Android Banking App-Cloning Campaign
GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.
The GoldFactory threat group is running an app-cloning campaign against Android banking customers in Indonesia, abusing the Android Work Profile feature to deliver its Gigabud trojan. The Mantax and Otax malware families are spreading through separate distribution channels. Abusing Work Profile to install or conceal cloned banking apps is a notable mobile technique, though the article reports no victim counts or loss figures.
- GoldFactory abuses the Android Work Profile feature to deliver the Gigabud banking trojan in Indonesia.
- Cloned banking apps are the campaign's delivery vehicle, targeting Indonesian Android banking customers.
- Mantax and Otax malware are spreading through separate distribution channels.
- Vendors
- GoldFactory
- Products
- AndroidAndroid Work Profile
- Threat actors
- GoldFactory
- Countries
- Indonesia
From the original article
The GoldFactory threat group exploits the Android Work Profile feature to deliver the Gigabud Trojan, while Mantax Otax spreads separately.
By Alexander Culafi · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.