Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
Gigabud Android Banking Trojan Clones Banking Apps via (TL-2026-2444) is a high-severity malware campaign, first published 2026-09-11. It is attributed to GoldFactory (China) with medium confidence, affects Google Android OS, maps to 10 MITRE ATT&CK techniques (T1417.001, T1417.002, T1418), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-2444
- Threat ID
- TL-2026-2444
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-11
- Last reviewed
- 2026-09-11
- Attribution
- GoldFactory
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- financial services, banking, mobile banking customers
- Target regions
- indonesia, Southeast Asia, brazil, colombia, egypt, laos, mexico, morocco, philippines, thailand, Türkiye, Gulf Cooperation Council
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in Gigabud Android Banking Trojan Clones Banking Apps via
Malware and tooling: Android/Trojan.Banker.ACR577B2BA2H61, Android/Trojan.Banker.ACR6C67829FH20, Android/Trojan.Banker.ACRF6CE8D30H46, Android/Trojan.Banker.AUR2f2f4fb5C95, Android/Trojan.Banker.SIB0181193e44H71, Android/Trojan.Banker.SIB02FFFFFF1112H106, Android/Trojan.Spy.Gigabud.xc, Gigabud, GoldDigger, GoldDiggerPlus, GoldKefu, GoldPickaxe
The Gigabud Android RAT lures victims into sideloading fake airline, tax, or government apps, abuses Accessibility and overlay permissions to steal credentials/PINs, then deploys a second component ('Vwork', a weaponized fork of the open-source Shelter app cloner) that creates a hidden Android work profile and clones the victim's banking app inside it. Operators remotely conduct fraudulent transactions from the isolated, cloned app — invisible to the personal profile's fraud/malware signals and optionally hidden behind a black screen. Group-IB attributes the campaign to GoldFactory, a financially motivated, Chinese-speaking mobile-malware group also behind GoldDigger, GoldKefu, and the face-stealing GoldPickaxe/GoldPickaxe.iOS trojans; between February and July 2026 it observed roughly 1,469 compromised devices and 1,281 possibly compromised logins in Indonesia alone, with estimated losses near $960,939, and found Gigabud+Vwork samples built for 10 additional countries.
How Gigabud Android Banking Trojan Clones Banking Apps via works
Gigabud is an Android remote-access trojan that Group-IB has tracked since mid-2022/2023, historically distributed in two variants — Gigabud.RAT (full device-control trojan) and Gigabud.Loan (a fake-loan data-harvesting variant with no RAT capability) — both signed with the same certificate and attributed to the same developer. The current campaign, reported by Group-IB on 2026-09-09 and summarized by Malwarebytes on 2026-09-11, adds a new second-stage component to the RAT variant's kill chain.
Victims are lured via phishing websites, instant-messenger (smishing) messages, or social-media posts into sideloading a fake application impersonating a national airline, a tax office, or a government portal. On first run Gigabud requests three permissions that form the backbone of the attack: Accessibility Service access, permission to draw overlays on top of other apps, and battery-optimization exemption (to keep running in the background). With Accessibility granted, the operator gets live remote control of the device: a full inventory of installed applications (to identify which banking apps are present), the ability to record the screen, inject synthetic touch/keyboard input via Android's accessibility APIs, and the ability to render a full-screen overlay that is invisible to the user — used both to display fake banking login pages that capture credentials and to capture the device's lock-screen PIN/pattern.
Within minutes of the initial Gigabud infection, the operator pushes a second app, 'Vwork' (package net.yy.vwork), described by Group-IB as a malicious fork of the legitimate open-source Android app-cloning tool Shelter. Vwork mirrors Shelter's class structure but removes the checks that normally require direct, manual user interaction, so any app on the device — specifically Gigabud, over a command channel — can drive it programmatically. Vwork also suppresses its own launcher icon (it remains visible only via a file manager) and strips the safeguards Android normally places around cross-profile interaction. Using a single provisioning prompt (versus Shelter's multi-step flow), Vwork creates a new Android 'work profile' — a feature normally reserved for employer-managed apps that Android isolates from the personal profile — and clones the targeted banking app into it. In the documented Indonesian case the cloned app was not literally the victim's own installed app but a tampered copy of a real Indonesian bank's app.
Because Android's work-profile isolation prevents state and detection signals from one profile reaching another, any fraud-detection or device-risk checks the banking app performs inside the compromised personal profile never see the malware; the fraudulent session instead runs from a profile that looks clean. From there, the operator uses the same accessibility-driven input-injection capability to log into the cloned app and execute unauthorized transactions, optionally covering the screen with an invisible black overlay so the on-device user sees nothing while the fraud is carried out.
Group-IB links Gigabud and Vwork to GoldFactory — a well-resourced, financially motivated Chinese-speaking mobile-malware development group Group-IB has tracked since at least June 2023, first publicized in August 2023 over the GoldDigger Android banking trojan (targeting 50+ Vietnamese banking/e-wallet/crypto apps) and later GoldPickaxe/GoldPickaxe.iOS, the first-documented iOS trojan built to harvest victims' facial-recognition data for AI deepfake-assisted bank-account takeover. The attribution to the Gigabud/Vwork campaign rests on three technical linkages Group-IB cites: Vwork code branches that reference Gigabud package names, shared network indicators between the two tools, and developer debug logs written in Chinese. A related, earlier GoldFactory wave using tampered banking apps against Southeast Asia (11,000+ infections) was reported in December 2025.
Confirmed full infection chains (Gigabud + Vwork + cloned bank app) were observed only in Indonesia, where Group-IB counted approximately 1,469 compromised devices and 1,281 possibly compromised banking logins between February and July 2026, with estimated financial losses of roughly $960,939 — described as observed activity, not a national total. Gigabud samples compiled to work with Vwork were additionally found targeting Brazil, Colombia, Egypt, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and one unnamed Gulf Cooperation Council member state, indicating the operation is being staged for wider rollout beyond Indonesia. Group-IB notes Vwork's added cloning functionality is still 'unstable' and does not behave consistently across Android builds close to the open-source Shelter baseline, suggesting the tool is under active development.
Malwarebytes lists seven detection signatures tied to this activity (Android/Trojan.Banker.* and Android/Trojan.Spy.Gigabud.xc family names). Defensive guidance from both vendors centers on refusing Accessibility permission grants to apps with no legitimate accessibility use case, installing apps only from official stores, watching for unexpected Android work-profile creation (visible under Settings > Passwords and Accounts / work profile settings) as a fraud signal, and using non-SMS multi-factor authentication for banking.
MITRE ATT&CK techniques used in TL-2026-2444
collection
credential-access
Discovery
T1418 Software Discovery; T1420 File and Directory Discovery
Collection
Impact
privilege-escalation
T1626 Abuse Elevation Control Mechanism
defense-evasion
T1628.001 Suppress Application Icon; T1655 Masquerading
Initial Access
Affected products and versions in Gigabud Android Banking Trojan Clones Banking Apps via
- Google — Android OS
Vulnerable versions: Android builds supporting Accessibility Service, overlay windows (SYSTEM_ALERT_WINDOW), and managed/work profile provisioning - Various Indonesian and regional financial institutions — Android mobile banking applications
Vulnerable versions: Confirmed: at least one unnamed major Indonesian bank's Android app (cloned by Vwork); samples also compiled to target banking apps in Brazil, Colombia, Egypt, Laos, Mexico, Morocco, Philippines, Thailand, Türkiye, and a GCC member state
Remediation for Gigabud Android Banking Trojan Clones Banking Apps via
Immediate actions
- Uninstall any app sideloaded from outside Google Play, particularly ones impersonating an airline, tax authority, or government portal
- Revoke Accessibility Service access from any app without a clear, legitimate accessibility use case (Settings > Accessibility)
- Revoke the 'display over other apps' (overlay) permission from unrecognized or recently sideloaded apps
- Check Settings > Passwords and Accounts (or Work profile settings) for an unexpected work profile and delete it if the user did not provision it themselves; note this removes everything stored inside the profile but does not by itself remove Gigabud from the personal profile
Workarounds
- Disable 'install unknown apps' / REQUEST_INSTALL_PACKAGES for browsers and messaging apps to prevent silent sideloading
- Use non-SMS multi-factor authentication (e.g., hardware token or authenticator app) for banking so a compromised device cannot self-approve transactions
Longer-term hardening
- Enforce app installation only from official app stores via MDM/enterprise policy on managed fleets
- Deploy mobile fraud-detection SDKs capable of flagging Accessibility Service abuse, screen-recording/casting activity, and accessibility-driven input injection
- Bind banking logins to trusted, previously-registered devices and step up authentication or block transactions when an Accessibility-privileged app is present on the device
- Monitor for anomalous managed/work-profile creation events on consumer (non-enterprise-enrolled) devices as a fraud-risk signal, especially when the same banking app shows install markers in both the personal and work profile
Timeline of Gigabud Android Banking Trojan Clones Banking Apps via
- Gigabud Android RAT first observed active in the wild (Gigabud.RAT and Gigabud.Loan variants), per Group-IB historical research.
- GoldFactory, the Chinese-speaking mobile-malware development group later linked to Gigabud and Vwork, assessed by Group-IB to be active from this point.
- Group-IB first publicly identifies GoldFactory, reporting the GoldDigger Android banking trojan targeting 50+ Vietnamese banking, e-wallet, and crypto-wallet apps.
- Group-IB discloses GoldPickaxe/GoldPickaxe.iOS, the first documented iOS trojan built to harvest victim facial-recognition data for AI deepfake-assisted bank fraud, attributed to GoldFactory.
- A GoldFactory campaign distributing tampered banking apps drives 11,000+ infections across Southeast Asia, reported by media citing Group-IB research.
- Start of the Group-IB observation window for the current Gigabud+Vwork hidden work-profile campaign in Indonesia.
- End of the Feb-Jul 2026 observation window: ~1,469 compromised Indonesian devices, ~1,281 possibly compromised logins, and roughly $960,939 in estimated losses recorded by Group-IB.
- Group-IB publishes research attributing the Vwork hidden-work-profile technique and Gigabud campaign to GoldFactory, disclosing samples compiled for 10 additional target countries beyond Indonesia.
- Malwarebytes Labs publishes coverage of the Gigabud/Vwork hidden work-profile technique, the article that seeded this threat record.
Sources cited for Gigabud Android Banking Trojan Clones Banking Apps via
- Android malware creates a hidden copy of your banking app
- Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
- Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection
- Gigabud banking trojan uses app cloning to evade fraud detection
- Gigabud Uses Android App Cloning to Evade Fraud Detection
- Breaking down Gigabud banking malware with Fraud Matrix
- GoldFactory Hits Southeast Asia with Modified Banking Apps Driving 11,000+ Infections
- Gold Rush is back to APAC: Group-IB unveils first iOS trojan stealing your face
- Face Off: Group-IB identifies first iOS trojan stealing facial recognition data
- iOS users beware: GoldPickaxe trojan steals your facial data
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
- SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attacks
Detection coverage for TL-2026-2444
As of 2026-09-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2444 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.