Gigabud Uses Android App Cloning to Evade Fraud Detection

Group-IB reports the Gigabud Android banking trojan clones bank apps into isolated work profiles via the Vwork tool to evade fraud detection, with roughly $960,000 in losses in Indonesia.

Group-IB found Gigabud now ships dedicated code to work with Vwork, a weaponized fork of the open-source Android cloning app Shelter it attributes to GoldFactory, exposing cloning functions so any installed app can call them. After installing via phishing sites and messengers posing as airline, tax and government apps, operators request accessibility and overlay permissions, then clone the victim's banking app into a new work profile where it is invisible to signature-based detection in the personal profile. Fake login screens and overlays capture credentials while cloned-app transactions appear to banks as coming from an unrecognized, malware-free device. Between February and July 2026 in Indonesia, Group-IB observed about 1,469 compromised devices, 1,281 potentially compromised logins and estimated losses of roughly $960,939, with Vwork-enabled samples targeting 11 countries including Brazil, Mexico, Egypt and Thailand.