Gigabud creates an Android work profile to put its fake bank app out of the scanner's reach
Group-IB says a second app sets up the work profile within minutes of infection and clones a fake bank app into it, so the malware check inside that app looks at an empty room while the trojan runs in the personal space.
The Watch · Security desk
What happened
- Group-IB, in a report published September 9, said the Gigabud banking trojan now installs a second Android app that creates a work profile on the infected phone.
- On devices in Indonesia the installs arrived in a fixed order: Gigabud first, the profile tool within minutes, then the tampered banking app inside the new profile.
- Between February and July 2026 Group-IB counted about 1,469 compromised devices and 1,281 possibly compromised logins in Indonesia, with estimated losses of about $960,000.
- Gigabud samples built to pair with Vwork point at twelve countries, eleven of them named, but Group-IB has confirmed the working chain only in Indonesia.
Why it matters
- What it limits constraint A malware scan run inside a banking app now describes one profile, not the handset, which removes it as evidence about whether the phone is clean when a payment is authorised.
- Who has to decide decision Banks that treat a clean on-device check as a fraud signal have to decide what replaces it on the server side, because the attacker now chooses which space the app is allowed to look at.
- What's now possible capability Stripping the caller checks turns profile creation and app cloning into functions any installed app can request, so the next family to use the trick does not have to implement it.
- Who's exposed exposure How wide the exposure runs is still unmeasured: one sample, in active development, and no published list of the builds where the cloning works as intended.
Next story · Product · 2d ago
Google's opt-in Messages setting has Gemini judge what unknown senders wantConfirmed6 publishers
Android's documentation says any app in the phone's main profile can start work profile setup, and that the user is told what a work profile does before one exists [20]. Group-IB says Vwork cuts Shelter's several screens down to a single prompt, written in Chinese [13]. On a handset in Indonesia, a Chinese-language provisioning prompt is an oddity in itself. The report does not say whether Gigabud approves that prompt itself; it does say Gigabud asks for Accessibility access on first launch, and that Accessibility is how the operator taps and types on the device behind a black screen [6][8].
Shelter is driven by hand, by the person holding the phone [10]. Vwork opens the same jobs to other apps, and Group-IB says the checks that stopped other apps from calling those functions have been taken out, so any app on the device can order a profile, clone an app into it, list what is inside, and open it [10][11]. Vwork asks an external server for permission before it clones, and Gigabud ships commands written for it [12]. That is the part with legs. Work profile abuse becomes a callable service rather than something each malware family has to build.
In the one case the report walks through in detail, what landed inside the profile was not a copy of the victim's own banking app but a fake version of a real Indonesian bank's app [16]. The profile is hosting an attacker-supplied build. The platform boundary works for the operator: the security code a banking app carries to look for known malware cannot reach the personal space where the trojan sits [4]. A fraudulent payment then looks unrelated to any alert already raised on the phone [3].
The observed Indonesian losses average about $653 per compromised device [22]. Group-IB says the counts are what it saw rather than a national total, and it does not say how many of those devices had Vwork on them [18].
One Vwork sample was analysed. Group-IB calls it still under active development, says some of the added functions are unstable on Android builds close to the open-source original, and does not name the phones or Android versions where the technique does work [21]. The link between Vwork and GoldFactory rests on a code branch referencing Gigabud package names, network indicators the two share, and developer logs in Chinese, none of which Group-IB will publish [19].
A work profile is a space Android reserves for employer apps [2]. Its appearance on a consumer handset with no employer behind it is one of the few local signals left, and a bank sees it only if its app is asking.
What to watch
- Whether Group-IB or Google names the Android versions on which Vwork's cloning functions are stable.
- Whether a Gigabud plus Vwork chain is confirmed outside Indonesia in any of the eleven named sample targets.
- Whether Google narrows which apps can start work profile provisioning, or banking SDKs begin reporting profile provenance to the server.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption30
- Hype gap+15
- Incentives50
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 23%
- Operator
- Operator 67%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
In a report published September 9, Group-IB said the Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it.
- [2]
A work profile is a separate space that Android typically reserves for employer apps, and what is inside it is kept separate from everything in the personal space.
- [3]
Group-IB said the profile split hides the trojan from the banking app's own malware checks, so a fraudulent payment can look unrelated to the alert already raised on the phone.
- [4]
Group-IB said banking apps carry security code that looks for known malware on the phone, and that from inside a work profile that scan does not reach the personal space where the trojan sits.
- [5]
Gigabud is a remote access trojan active since 2022 that Group-IB links to a group it calls GoldFactory, reaching phones as a fake app posing as a national airline, a tax office or a government portal, installed from outside the official store.
- [6]
On first launch Gigabud asks for Accessibility access, permission to draw over other apps, and permission to keep running in the background; Group-IB said giving it Accessibility access is the point where the operator gains real control of the device.
- [7]
Gigabud sends the operator a list of every app on the phone, then shows a fake login screen over the real banking app to capture keystrokes, with a second overlay invisible to the user taking the phone's lock screen code.
- [8]
Group-IB said the operator can run transactions on the victim's phone by tapping and typing through Accessibility while a black screen covers what is happening.
- [9]
The second app is called Vwork, and Group-IB said its architecture and class names match Shelter, an open-source tool that uses the same work profile feature to let a phone's owner isolate or duplicate apps.
- [10]
Shelter is worked by hand by the person holding the phone, while Vwork opens the same jobs to other apps: set up a work profile, clone an app into it, list what is in there, and open an app inside.
- [11]
Group-IB said the checks that stopped other apps from calling those functions have been taken out of Vwork, so any app on the device can drive it.
- [12]
Before it clones anything, Vwork asks an external server for permission, and Gigabud carries commands written specifically for it.
- [13]
Group-IB said Shelter walks a user through several screens before creating a profile, while Vwork cuts that down to a single prompt written in Chinese.
- [14]
Group-IB said it has confirmed the full chain on infected devices in Indonesia.
- [15]
On devices in Indonesia, Group-IB said the installs arrived in order: Gigabud first, Vwork within minutes, then the tampered banking app.
- [16]
In the one case the report describes in detail, what went into the profile was not a duplicate of the victim's own banking app; Group-IB said the copy was a fake version of a real Indonesian bank's app.
- [17]
Gigabud samples built to work with Vwork have been found aimed at Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Turkiye and one unnamed Gulf Cooperation Council country; Group-IB said those are samples, not confirmed infections.
- [18]
Between February and July 2026 Group-IB counted about 1,469 compromised devices and 1,281 possibly compromised logins in Indonesia, with estimated losses of about $960,000; it said the counts cover what it observed rather than the country as a whole, and it did not say how many of those devices had Vwork on them.
- [19]
Group-IB links both tools to GoldFactory, pointing to a branch of Vwork's code that references Gigabud package names, network indicators the two share, and developer logs written in Chinese, and said it cannot publish those indicators.
- [20]
Android's platform documentation says any app in the phone's main profile can start the setup for a work profile, and that the user is told what a work profile does before one is created.
- [21]
Group-IB analyzed a single Vwork sample and described it as still under active development, with some added functions unstable on Android builds close to the open-source version; the report does not say which phones or Android versions the technique does work on.
- [22]
Group-IB's observed Indonesian figures average about $653 in estimated losses per compromised device.
- [23]
The Vwork-compatible Gigabud sample set points at twelve countries, eleven of them named.
Sources
3 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comGigabud Uses Android App Cloning to Evade Fraud Detection
1 article · September 9, 2026
- malwarebytes.comAndroid malware creates a hidden copy of your banking app
1 article · September 11, 2026
- thehackernews.comGigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
2 articles · September 10, 2026
Topics and entities
Entities
- Android Work Profile
- Android
- Group-IB
- Malwarebytes