Security1 publisher3 min readPublished
Gigabud creates an Android work profile to put its fake bank app out of the scanner's reach
Group-IB says a second app sets up the work profile within minutes of infection and clones a fake bank app into it, so the malware check inside that app looks at an empty room while the trojan runs in the personal space.
The Watch · Security desk
What happened
- Group-IB, in a report published September 9, said the Gigabud banking trojan now installs a second Android app that creates a work profile on the infected phone.
- On devices in Indonesia the installs arrived in a fixed order: Gigabud first, the profile tool within minutes, then the tampered banking app inside the new profile.
- Between February and July 2026 Group-IB counted about 1,469 compromised devices and 1,281 possibly compromised logins in Indonesia, with estimated losses of about $960,000.
- Gigabud samples built to pair with Vwork point at twelve countries, eleven of them named, but Group-IB has confirmed the working chain only in Indonesia.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint A malware scan run inside a banking app now describes one profile, not the handset, which removes it as evidence about whether the phone is clean when a payment is authorised.
- decision Banks that treat a clean on-device check as a fraud signal have to decide what replaces it on the server side, because the attacker now chooses which space the app is allowed to look at.
- capability Stripping the caller checks turns profile creation and app cloning into functions any installed app can request, so the next family to use the trick does not have to implement it.
- exposure How wide the exposure runs is still unmeasured: one sample, in active development, and no published list of the builds where the cloning works as intended.
Android's documentation says any app in the phone's main profile can start work profile setup, and that the user is told what a work profile does before one exists [5]. Group-IB says Vwork cuts Shelter's several screens down to a single prompt, written in Chinese [15]. On a handset in Indonesia, a Chinese-language provisioning prompt is an oddity in itself. The report does not say whether Gigabud approves that prompt itself; it does say Gigabud asks for Accessibility access on first launch, and that Accessibility is how the operator taps and types on the device behind a black screen [8][10].
Shelter is driven by hand, by the person holding the phone [12]. Vwork opens the same jobs to other apps, and Group-IB says the checks that stopped other apps from calling those functions have been taken out, so any app on the device can order a profile, clone an app into it, list what is inside, and open it [12][13]. Vwork asks an external server for permission before it clones, and Gigabud ships commands written for it [14]. That is the part with legs. Work profile abuse becomes a callable service rather than something each malware family has to build.
In the one case the report walks through in detail, what landed inside the profile was not a copy of the victim's own banking app but a fake version of a real Indonesian bank's app [17]. The profile is hosting an attacker-supplied build. The platform boundary works for the operator: the security code a banking app carries to look for known malware cannot reach the personal space where the trojan sits [6]. A fraudulent payment then looks unrelated to any alert already raised on the phone [3].
The observed Indonesian losses average about $653 per compromised device [22]. Group-IB says the counts are what it saw rather than a national total, and it does not say how many of those devices had Vwork on them [20].
One Vwork sample was analysed. Group-IB calls it still under active development, says some of the added functions are unstable on Android builds close to the open-source original, and does not name the phones or Android versions where the technique does work [18]. The link between Vwork and GoldFactory rests on a code branch referencing Gigabud package names, network indicators the two share, and developer logs in Chinese, none of which Group-IB will publish [21].
A work profile is a space Android reserves for employer apps [2]. Its appearance on a consumer handset with no employer behind it is one of the few local signals left, and a bank sees it only if its app is asking.
What to watch
- Whether Group-IB or Google names the Android versions on which Vwork's cloning functions are stable.
- Whether a Gigabud plus Vwork chain is confirmed outside Indonesia in any of the eleven named sample targets.
- Whether Google narrows which apps can start work profile provisioning, or banking SDKs begin reporting profile provenance to the server.