The Gigabud Android banking trojan has been equipped to clone banking apps into a separate Android work profile, giving fraudsters a way to break the link between a malware alert and the transaction that follows it.
Group-IB said in research published on September 9 that Gigabud was being paired with Vwork, a weaponized fork of the open-source Android cloning app Shelter. It attributed both to GoldFactory, concluding the group had developed or customized each.
The full infection chain was confirmed only on devices in Indonesia. Gigabud samples built to work with Vwork were found to be targeting 11 countries, among them Brazil, Colombia, Egypt, Mexico, Thailand and Turkiye.
Vwork Hides Banking Apps in Work Profiles
Vwork uses Android's Work Profile feature for app cloning into an isolated environment. Where Shelter is meant to be driven by the device owner, Group-IB said Vwork exposed its cloning functions as an interface any other app on the device could call.
Gigabud samples carried dedicated code for it, including three new commands to provision the profile, clone a named app and report back what had been cloned. Cloning requires a token from an external authorization server, which Gigabud retrieves.
Group-IB said the point is detection isolation: apps in one profile are largely invisible to signature-based detection in another, so an alert raised in the personal profile does not fire in a work profile created afterwards.
Operators install the malware, wait, then clone the bank's app into the new profile and transact from there. To the bank the payment appears to come from an unrecognized device with no malware history.
Fake login screens then capture banking credentials while a separate invisible overlay takes the lock screen code. During the fraud itself a black screen conceals what is happening on the handset.
Fraud Detection Faces a New Separation Problem
In Indonesia between February and July 2026, Group-IB observed about 1469 compromised devices and 1281 potentially compromised logins, with estimated losses of roughly $960,939. It called the figures indicative rather than representative of the region.
Gigabud, active since 2022, reaches victims through phishing sites, messengers and social media, posing as airline, tax authority or government apps. On first launch it requests accessibility access, overlay permission and a battery exemption, the first of which is where the operator gains control.
Group-IB named six behavioral signals for banks, including a work profile appearing on a phone the user never set up, matching banking app markers across profiles, an otherwise empty isolated environment and accessibility access on an app with no reason for needing it.
Two or more together should be treated as a high-risk session, said Group-IB. Its other advice was device binding to stop stolen logins authorizing payments, and for users, official stores only.