# Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)

> The Gigabud Android RAT lures victims into sideloading fake airline, tax, or government apps, abuses Accessibility and overlay permissions to steal credentials/PINs, then deploys a second component ('Vwork', a weaponized fork of the open-source Shelter app cloner) that creates a hidden Android work profile and clones the victim's banking app inside it. Operators remotely conduct fraudulent transactions from the isolated, cloned app — invisible to the personal profile's fraud/malware signals and optionally hidden behind a black screen. Group-IB attributes the campaign to GoldFactory, a financially motivated, Chinese-speaking mobile-malware group also behind GoldDigger, GoldKefu, and the face-stealing GoldPickaxe/GoldPickaxe.iOS trojans; between February and July 2026 it observed roughly 1,469 compromised devices and 1,281 possibly compromised logins in Indonesia alone, with estimated losses near $960,939, and found Gigabud+Vwork samples built for 10 additional countries.

- **Published:** 2026-09-11T00:00:00Z
- **Last reviewed:** 2026-09-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2444
- **ID:** TL-2026-2444
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** GoldFactory (China)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Gigabud is an Android remote-access trojan that Group-IB has tracked since mid-2022/2023, historically distributed in two variants — Gigabud.RAT (full device-control trojan) and Gigabud.Loan (a fake-loan data-harvesting variant with no RAT capability) — both signed with the same certificate and attributed to the same developer. The current campaign, reported by Group-IB on 2026-09-09 and summarized by Malwarebytes on 2026-09-11, adds a new second-stage component to the RAT variant's kill chain.

Victims are lured via phishing websites, instant-messenger (smishing) messages, or social-media posts into sideloading a fake application impersonating a national airline, a tax office, or a government portal. On first run Gigabud requests three permissions that form the backbone of the attack: Accessibility Service access, permission to draw overlays on top of other apps, and battery-optimization exemption (to keep running in the background). With Accessibility granted, the operator gets live remote control of the device: a full inventory of installed applications (to identify which banking apps are present), the ability to record the screen, inject synthetic touch/keyboard input via Android's accessibility APIs, and the ability to render a full-screen overlay that is invisible to the user — used both to display fake banking login pages that capture credentials and to capture the device's lock-screen PIN/pattern.

Within minutes of the initial Gigabud infection, the operator pushes a second app, 'Vwork' (package net.yy.vwork), described by Group-IB as a malicious fork of the legitimate open-source Android app-cloning tool Shelter. Vwork mirrors Shelter's class structure but removes the checks that normally require direct, manual user interaction, so any app on the device — specifically Gigabud, over a command channel — can drive it programmatically. Vwork also suppresses its own launcher icon (it remains visible only via a file manager) and strips the safeguards Android normally places around cross-profile interaction. Using a single provisioning prompt (versus Shelter's multi-step flow), Vwork creates a new Android 'work profile' — a feature normally reserved for employer-managed apps that Android isolates from the personal profile — and clones the targeted banking app into it. In the documented Indonesian case the cloned app was not literally the victim's own installed app but a tampered copy of a real Indonesian bank's app.

Because Android's work-profile isolation prevents state and detection signals from one profile reaching another, any fraud-detection or device-risk checks the banking app performs inside the compromised personal profile never see the malware; the fraudulent session instead runs from a profile that looks clean. From there, the operator uses the same accessibility-driven input-injection capability to log into the cloned app and execute unauthorized transactions, optionally covering the screen with an invisible black overlay so the on-device user sees nothing while the fraud is carried out.

Group-IB links Gigabud and Vwork to GoldFactory — a well-resourced, financially motivated Chinese-speaking mobile-malware development group Group-IB has tracked since at least June 2023, first publicized in August 2023 over the GoldDigger Android banking trojan (targeting 50+ Vietnamese banking/e-wallet/crypto apps) and later GoldPickaxe/GoldPickaxe.iOS, the first-documented iOS trojan built to harvest victims' facial-recognition data for AI deepfake-assisted bank-account takeover. The attribution to the Gigabud/Vwork campaign rests on three technical linkages Group-IB cites: Vwork code branches that reference Gigabud package names, shared network indicators between the two tools, and developer debug logs written in Chinese. A related, earlier GoldFactory wave using tampered banking apps against Southeast Asia (11,000+ infections) was reported in December 2025.

Confirmed full infection chains (Gigabud + Vwork + cloned bank app) were observed only in Indonesia, where Group-IB counted approximately 1,469 compromised devices and 1,281 possibly compromised banking logins between February and July 2026, with estimated financial losses of roughly $960,939 — described as observed activity, not a national total. Gigabud samples compiled to work with Vwork were additionally found targeting Brazil, Colombia, Egypt, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and one unnamed Gulf Cooperation Council member state, indicating the operation is being staged for wider rollout beyond Indonesia. Group-IB notes Vwork's added cloning functionality is still 'unstable' and does not behave consistently across Android builds close to the open-source Shelter baseline, suggesting the tool is under active development.

Malwarebytes lists seven detection signatures tied to this activity (Android/Trojan.Banker.* and Android/Trojan.Spy.Gigabud.xc family names). Defensive guidance from both vendors centers on refusing Accessibility permission grants to apps with no legitimate accessibility use case, installing apps only from official stores, watching for unexpected Android work-profile creation (visible under Settings > Passwords and Accounts / work profile settings) as a fraud signal, and using non-SMS multi-factor authentication for banking.

## MITRE ATT&CK

- T1660 Phishing
- T1655 Masquerading
- T1418 Software Discovery
- T1420 File and Directory Discovery
- T1417.001 Keylogging
- T1417.002 GUI Input Capture
- T1513 Screen Capture
- T1516 Input Injection
- T1628.001 Suppress Application Icon
- T1626 Abuse Elevation Control Mechanism

## Sources

- [Android malware creates a hidden copy of your banking app](https://www.malwarebytes.com/blog/mobile/2026/09/android-malware-creates-a-hidden-copy-of-your-banking-app)
- [Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks](https://thehackernews.com/2026/09/gigabud-creates-android-work-profiles.html)
- [Hackers Clone Banking Apps Into Hidden Android Work Profiles to Evade Fraud Detection](https://cybersecuritynews.com/hackers-clone-banking-apps/)
- [Gigabud banking trojan uses app cloning to evade fraud detection](https://www.scworld.com/brief/gigabud-banking-trojan-uses-app-cloning-to-evade-fraud-detection)
- [Gigabud Uses Android App Cloning to Evade Fraud Detection](https://www.infosecurity-magazine.com/news/gigabud-android-app-cloning-fraud/)
- [Breaking down Gigabud banking malware with Fraud Matrix](https://www.group-ib.com/blog/gigabud-banking-malware/)
- [GoldFactory Hits Southeast Asia with Modified Banking Apps Driving 11,000+ Infections](https://thehackernews.com/2025/12/goldfactory-hits-southeast-asia-with.html)
- [Gold Rush is back to APAC: Group-IB unveils first iOS trojan stealing your face](https://www.group-ib.com/media-center/press-releases/goldfactory-ios-trojan/)
- [Face Off: Group-IB identifies first iOS trojan stealing facial recognition data](https://www.group-ib.com/blog/goldfactory-ios-trojan/)
- [iOS users beware: GoldPickaxe trojan steals your facial data](https://www.helpnetsecurity.com/2024/02/15/goldpickaxe-ios-trojan/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2444