# GoldFactory Android/iOS banking trojan campaign impersonating tax officers across Indonesia, Thailand and Vietnam

> Group-IB reports that GoldFactory, a Chinese-speaking financially motivated cluster, compromised roughly 11,000 devices in Indonesia, Thailand and Vietnam between July 2025 and January 2026. Victims were socially engineered by phone and WhatsApp voice impersonation of officials into sideloading a malicious APK; the malware abuses accessibility services, records the screen and harvests facial biometrics for deepfake-based verification bypass, with estimated losses of $1.5-2 million.

- **Published:** 2026-10-21T08:31:41Z
- **Last reviewed:** 2026-10-21T08:31:41Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4025
- **ID:** TL-2026-4025
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** GoldFactory (China)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GoldFactory is a well-organized, Chinese-speaking cybercrime group assessed to be active since at least June 2023 and closely connected to the Gigabud Android malware family. Its custom families include GoldDigger, GoldDiggerPlus, GoldKefu and GoldPickaxe (Android and iOS). Group-IB's August 2026 report ('One Adversary, Two Outcomes: The 0.027% Proof') documents a campaign running July 2025 to January 2026 in Indonesia, Thailand and Vietnam that compromised about 11,000 devices, used 228 malware samples and a centralized framework that generated 996 phishing URLs impersonating 16+ brands (ministries, airlines, pension funds, energy providers). Estimated fraud losses are $1.5-2 million. The infrastructure is run as a malware-as-a-service model with regional development and operator teams and is pre-configured for four additional markets. A successor variant was identified in December 2025.

The five-stage attack chain begins with a phone or WhatsApp voice call from a person impersonating a government or tax official, followed by migration to a messaging app (Zalo, LINE, WhatsApp) and delivery of a link to a fake government or brand site, fake Google Play landing page, Telegram channel or S3-hosted APK. The victim is coached step by step to sideload the APK and enable accessibility services. The malware then abuses accessibility services for keylogging, UI reading and automated gestures, records the screen in real time (including one-time codes), and captures facial biometrics and identity documents that are later used with face-swap/deepfake services to defeat bank liveness checks. Account takeover is completed through established mule networks.

Group-IB's earlier research (December 2025, 'Turning apps into gold') documents three hooking frameworks used to trojanize legitimate banking apps: FriHook (Frida gadget, libfy.so), SkyHook (Dobby, libdobbyhook.so) and PineHook (Pine Java method hooking). Over 300 unique modified banking-app samples were found, 27 original banking apps were injected and about 30 financial organizations targeted, with 63% of altered apps targeting Indonesia. Hooks on openat/newfstatat/readlink/getPackageInfo/ZipFile_open spoof APK signatures and base-APK paths; the malware also hides accessibility services, hides the installation source, evades screencast detection and uses control-flow flattening and XOR string encryption. The Gigaflower pre-release successor to Gigabud has roughly 48 C2 commands, WebRTC screen streaming, fake PIN/system-update/biometric overlays and Vietnamese identity-card QR/OCR scanning.

On iOS, GoldPickaxe.iOS (first documented in February 2024) was distributed via TestFlight and, after Apple blocked it, via MDM profiles. It records facial-recognition videos, collects ID photos, intercepts SMS via a Message Filter extension, syncs up to 100 recent photos, communicates over WebSocket port 8383 with a local SOCKS5 proxy and FRP, and stores data in Alibaba cloud storage. C2 domains follow a 4-5 character pattern on .cc then .xyz registered via Gname.com. The Group-IB blog for this specific report published no CVEs; CVSS is not applicable. BeaconBeagle returned no match for the queried C2 IP.

## MITRE ATT&CK

- T1583.001 Acquire Infrastructure: Domains
- T1583.006 Acquire Infrastructure: Web Services
- T1660 Phishing
- T1566.003 Phishing: Spearphishing via Service
- T1575 Native API
- T1406.002 Software Packing
- T1655.001 Masquerading: Match Legitimate Name or Location
- T1516 Input Injection
- T1633.001 Virtualization/Sandbox Evasion: System Checks
- T1417.001 Input Capture: Keylogging
- T1417.002 Input Capture: GUI Input Capture
- T1513 Screen Capture
- T1512 Video Capture
- T1636.004 Protected User Data: SMS Messages
- T1426 System Information Discovery
- T1437.001 Application Layer Protocol: Web Protocols
- T1481 Web Service
- T1604 Proxy Through Victim

## Sources

- [One Adversary, Two Outcomes: The 0.027% Proof (Group-IB)](https://www.group-ib.com/blog/one-adversary-two-outcomes-0027-proof/)
- [Turning Apps into Gold (Group-IB)](https://www.group-ib.com/blog/turning-apps-into-gold/)
- [GoldFactory Hits Southeast Asia with Fake Government Apps (The Hacker News)](https://thehackernews.com/2025/12/goldfactory-hits-southeast-asia-with.html)
- [Group-IB discovers first iOS trojan stealing your face (GoldPickaxe.iOS)](https://www.group-ib.com/blog/goldfactory-ios-trojan/)
- [Group-IB press release: Gold Rush is back to APAC](https://www.group-ib.com/media-center/press-releases/goldfactory-ios-trojan/)
- [iOS users beware: GoldPickaxe trojan steals your facial data (Help Net Security)](https://www.helpnetsecurity.com/2024/02/15/goldpickaxe-ios-trojan/)
- [Chinese Hackers Using Deepfakes in Mobile Banking Malware Attacks (The Hacker News)](https://thehackernews.com/2024/02/chinese-hackers-using-deepfakes-in.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4025