Android Work Profiles

Gigabud creates an Android work profile to put its fake bank app out of the scanner's reach

Group-IB says a second app sets up the work profile within minutes of infection and clones a fake bank app into it, so the malware check inside that app looks at an empty room while the trojan runs in the personal space.