Threat reportMalwareTL-2026-4025
GoldFactory Android/iOS banking trojan campaign impersonating tax officers across Indonesia, Thailand and Vietnam
GoldFactory Android/iOS banking trojan campaign (TL-2026-4025), also tracked as GoldDigger, is a high-severity malware campaign, first published 2026-10-21. It is attributed to GoldFactory (China) with medium confidence, affects Google Android, maps to 18 MITRE ATT&CK techniques (T1406.002, T1417.001, T1417.002), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 1GoldFactory
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4025
- Threat ID
- TL-2026-4025
- Also known as
- GoldDigger, GoldDiggerPlus, GoldKefu, GoldPickaxe, Gigabud, Gigaflower
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- GoldFactory
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- FINANCIAL
- Target sectors
- finance, government administration, energy, aviation, pension
- Target regions
- indonesia, thailand, vietnam
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in GoldFactory Android/iOS banking trojan campaign
Malware and tooling: Gigabud, GoldDigger, Remo
How GoldFactory Android/iOS banking trojan campaign works
Group-IB reports that GoldFactory, a Chinese-speaking financially motivated cluster, compromised roughly 11,000 devices in Indonesia, Thailand and Vietnam between July 2025 and January 2026. Victims were socially engineered by phone and WhatsApp voice impersonation of officials into sideloading a malicious APK; the malware abuses accessibility services, records the screen and harvests facial biometrics for deepfake-based verification bypass, with estimated losses of $1.5-2 million.
GoldFactory is a well-organized, Chinese-speaking cybercrime group assessed to be active since at least June 2023 and closely connected to the Gigabud Android malware family. Its custom families include GoldDigger, GoldDiggerPlus, GoldKefu and GoldPickaxe (Android and iOS). Group-IB's August 2026 report ('One Adversary, Two Outcomes: The 0.027% Proof') documents a campaign running July 2025 to January 2026 in Indonesia, Thailand and Vietnam that compromised about 11,000 devices, used 228 malware samples and a centralized framework that generated 996 phishing URLs impersonating 16+ brands (ministries, airlines, pension funds, energy providers). Estimated fraud losses are $1.5-2 million. The infrastructure is run as a malware-as-a-service model with regional development and operator teams and is pre-configured for four additional markets. A successor variant was identified in December 2025.
The five-stage attack chain begins with a phone or WhatsApp voice call from a person impersonating a government or tax official, followed by migration to a messaging app (Zalo, LINE, WhatsApp) and delivery of a link to a fake government or brand site, fake Google Play landing page, Telegram channel or S3-hosted APK. The victim is coached step by step to sideload the APK and enable accessibility services. The malware then abuses accessibility services for keylogging, UI reading and automated gestures, records the screen in real time (including one-time codes), and captures facial biometrics and identity documents that are later used with face-swap/deepfake services to defeat bank liveness checks. Account takeover is completed through established mule networks.
Group-IB's earlier research (December 2025, 'Turning apps into gold') documents three hooking frameworks used to trojanize legitimate banking apps: FriHook (Frida gadget, libfy.so), SkyHook (Dobby, libdobbyhook.so) and PineHook (Pine Java method hooking). Over 300 unique modified banking-app samples were found, 27 original banking apps were injected and about 30 financial organizations targeted, with 63% of altered apps targeting Indonesia. Hooks on openat/newfstatat/readlink/getPackageInfo/ZipFile_open spoof APK signatures and base-APK paths; the malware also hides accessibility services, hides the installation source, evades screencast detection and uses control-flow flattening and XOR string encryption. The Gigaflower pre-release successor to Gigabud has roughly 48 C2 commands, WebRTC screen streaming, fake PIN/system-update/biometric overlays and Vietnamese identity-card QR/OCR scanning.
On iOS, GoldPickaxe.iOS (first documented in February 2024) was distributed via TestFlight and, after Apple blocked it, via MDM profiles. It records facial-recognition videos, collects ID photos, intercepts SMS via a Message Filter extension, syncs up to 100 recent photos, communicates over WebSocket port 8383 with a local SOCKS5 proxy and FRP, and stores data in Alibaba cloud storage. C2 domains follow a 4-5 character pattern on .cc then .xyz registered via Gname.com. The Group-IB blog for this specific report published no CVEs; CVSS is not applicable. BeaconBeagle returned no match for the queried C2 IP.
MITRE ATT&CK techniques used in TL-2026-4025
defense-evasion
T1406.002 Software Packing; T1516 Input Injection; T1604 Proxy Through Victim; T1633.001 Virtualization/Sandbox Evasion: System Checks; T1655.001 Masquerading: Match Legitimate Name or Location
collection
T1417.001 Input Capture: Keylogging
credential-access
T1417.002 Input Capture: GUI Input Capture
Discovery
T1426 System Information Discovery
command-and-control
T1437.001 Application Layer Protocol: Web Protocols; T1481 Web Service
Collection
T1512 Video Capture; T1513 Screen Capture; T1636.004 Protected User Data: SMS Messages
Initial Access
T1566.003 Phishing: Spearphishing via Service
Execution
Resource Development
T1583.001 Acquire Infrastructure: Domains; T1583.006 Acquire Infrastructure: Web Services
initial-access
Affected products and versions in GoldFactory Android/iOS banking trojan campaign
- Google — Android
Vulnerable versions: Devices permitting sideloaded APKs with accessibility services enabled - Apple — iOS
Vulnerable versions: Devices with TestFlight builds or MDM profiles installed from untrusted sources - Various — Mobile banking apps (Indonesia, Thailand, Vietnam)
Vulnerable versions: 27 original banking apps repackaged with hooking frameworks
Remediation for GoldFactory Android/iOS banking trojan campaign
Immediate actions
- Block the listed C2 domains and IPs at DNS and egress
- Alert customers that tax, pension and utility officials never request app installation via WhatsApp, Zalo or LINE calls
- Enable fraud controls on new-device enrollment, remote-access/overlay detection and mule-account monitoring
Workarounds
- Disable install from unknown sources on managed Android devices
- Do not install configuration (MDM) profiles or TestFlight builds from links received in chats
- Restrict accessibility-service grants to vetted apps
Longer-term hardening
- Deploy mobile app shielding with runtime integrity checks against Frida, Dobby and Pine hooking and signature spoofing
- Detect accessibility-service abuse, screen-recording and emulator conditions in banking apps and bind liveness checks to device attestation
- Layer face-liveness with deepfake/injection-attack detection and step-up authentication for high-value transfers
Timeline of GoldFactory Android/iOS banking trojan campaign
- GoldFactory assessed to be active since at least June 2023; Gigabud Android malware spotted mid-2023
- GoldDigger Android trojan and early GoldPickaxe.iOS identified targeting Thailand
- Group-IB publicly documents GoldPickaxe.iOS, the first iOS banking trojan stealing facial biometrics, distributed via TestFlight then MDM profiles
- New wave of modified banking apps delivering Android malware first detected in Thailand
- Activity expands to Vietnam (late 2024 to early 2025), impersonating EVN, health and public-security entities
- Indonesia surge begins; tax-officer/government impersonation campaign period starts (July 2025), later totalling ~11,000 compromised devices
- Group-IB reports FriHook, SkyHook and PineHook frameworks, 300+ modified banking-app samples and ~11,000 infections; successor variant identified
- End of observed campaign window (July 2025 to January 2026) with 996 phishing URLs and 228 samples
- Group-IB publishes 'One Adversary, Two Outcomes: The 0.027% Proof' with $1.5-2M estimated losses and fused-defense results
Sources cited for GoldFactory Android/iOS banking trojan campaign
- One Adversary, Two Outcomes: The 0.027% Proof (Group-IB)
- Turning Apps into Gold (Group-IB)
- GoldFactory Hits Southeast Asia with Fake Government Apps (The Hacker News)
- Group-IB discovers first iOS trojan stealing your face (GoldPickaxe.iOS)
- Group-IB press release: Gold Rush is back to APAC
- iOS users beware: GoldPickaxe trojan steals your facial data (Help Net Security)
- Chinese Hackers Using Deepfakes in Mobile Banking Malware Attacks (The Hacker News)
Detection coverage for TL-2026-4025
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4025 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.