The Gigabud Android banking trojan has been updated with functionality to clone legitimate banking applications into a separate Android work profile. This technique allows fraudsters to sever the connection between initial malware alerts and subsequent fraudulent transactions, according to research published by Group-IB on September 9.
Group-IB attributes the development of this capability to the GoldFactory threat group. The researchers identified that Gigabud is paired with Vwork, a weaponized fork of the open-source Android cloning app Shelter. While standard Shelter requires device owner privileges to operate, Vwork exposes its cloning functions through an interface accessible to any application on the infected device. Dedicated code within recent Gigabud samples includes commands to provision the work profile, clone specific named apps, and report back on the cloned items. This process requires a token retrieved from an external authorization server.
The primary objective of this architecture is detection isolation. Because applications in one Android profile are largely invisible to signature-based detection mechanisms operating in another, an alert triggered in the user’s personal profile does not activate within the newly created work profile. Operators install the malware, wait for a period, then clone the bank’s app into the isolated environment and conduct transactions from there. To the financial institution, the payment appears to originate from an unrecognized device with no prior malware history.
During the infection chain, fake login screens capture banking credentials, while a separate invisible overlay steals the lock screen code. A black screen conceals activity on the handset during the fraud itself. Although the full infection chain involving Vwork was confirmed only on devices in Indonesia, Gigabud samples built to work with Vwork were found targeting users in 11 countries, including Brazil, Colombia, Egypt, Mexico, Thailand, and Turkiye.
In Indonesia, between February and July 2026, Group-IB observed approximately 1,469 compromised devices and 1,281 potentially compromised logins. The estimated losses amounted to roughly $960,939. Group-IB noted these figures are indicative rather than representative of the broader region. Active since 2022, Gigabud reaches victims through phishing sites, messengers, and social media, often posing as airline, tax authority, or government applications. On first launch, it requests accessibility access, overlay permission, and battery exemption, with accessibility access providing the operator control.
Group-IB recommended six behavioral signals for banks to monitor, such as a work profile appearing on a phone the user never configured, matching banking app markers across different profiles, an otherwise empty isolated environment, and accessibility access granted to apps with no functional need for it. The firm advised treating two or more of these signals together as a high-risk session. Additional recommendations included implementing device binding to prevent stolen logins from authorizing payments and advising users to install apps only from official stores.
