Indonesia Hit by Android Banking App-Cloning Campaign

GoldFactory exploits Android Work Profile to deliver the Gigabud banking trojan to Indonesian users via cloned banking apps, with Mantax and Otax spreading separately.

The GoldFactory threat group is running an app-cloning campaign against Android banking customers in Indonesia, abusing the Android Work Profile feature to deliver its Gigabud trojan. The Mantax and Otax malware families are spreading through separate distribution channels. Abusing Work Profile to install or conceal cloned banking apps is a notable mobile technique, though the article reports no victim counts or loss figures.

• GoldFactory abuses the Android Work Profile feature to deliver the Gigabud banking trojan in Indonesia.
• Cloned banking apps are the campaign's delivery vehicle, targeting Indonesian Android banking customers.
• Mantax and Otax malware are spreading through separate distribution channels.