Skip to navigation

Threat reportMalwareTL-2026-4746

GoldFactory Vwork: Weaponized Shelter Fork Enables App Cloning Alongside Gigabud Android Banking Trojan

highACTIVE

Group-IB reports Vwork, a modified fork of the open-source Android app cloner Shelter, used as an add-on to the Gigabud banking trojan to create an isolated work profile on victim devices, clone banking apps and execute fraudulent transactions while evading fraud detection. First disclosed .

Key facts

IdentifiersTL-2026-4746
Also known asHook for Gold
SeverityHIGH
First disclosed
Affected productsGoogle Android (devices supporting Work Profile; banking apps cloned in Indonesia and other targeted countries)
AttributionGoldFactory (medium confidence)
Nation-state nexusChina
MalwareGigabud, Vwork
ToolsShelter, dpt-shell
MITRE ATT&CK techniquesT1406.002 Software Packing, T1417.002 GUI Input Capture, T1418 Software Discovery, T1437.001 Web Protocols, T1453 Abuse Accessibility Features, T1513 Screen Capture, T1516 Input Injection, T1521.001 Symmetric Cryptography, T1544 Ingress Tool Transfer, T1628.001 Suppress Application Icon, T1655.001 Match Legitimate Name or Location, T1660 Phishing
MotivationFINANCIAL
Target sectorsfinance, banking, cryptocurrency, government administration
Target regionsindonesia, brazil, colombia, egypt, laos, mexico, morocco, philippines, thailand, Turkiye, GCC
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4746 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Gigabud/Vwork Package, Hash and Shelter-Masquerade Detected in Mobile App Inventory

Behaviour-first inventory search for GoldFactory Vwork (net.yy.vwork), Gigabud samples, the nine published SHA256 hashes, and apps named Shelter whose package differs from the upstream net.typeblog.shelter. Indicates the sideloaded app stage that later enables work-profile app cloning for on-device banking fraud (TL-2026-4746).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1660, T1406.002, T1544, T1655.001
  • Data sources: mdm_app_inventory, intune:mobileapp:inventory
  • Severity: high
  • Confidence: high

Splunk SPL

index=mobile sourcetype="intune:mobileapp:inventory" earliest=-24h
    (package_name="net.yy.vwork" OR app_name IN ("Vwork","Gigabud","Gigabud.RAT") OR app_name="Shelter" OR sha256 IN ("b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501", "ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae", "4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc", "112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf", "9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611", "1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c", "0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3", "66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb", "61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc")) NOT package_name="net.typeblog.shelter"
| eval ioc=case(package_name=="net.yy.vwork","vwork_package", match(app_name,"(?i)^(vwork|gigabud)"),"gigabud_vwork_name", match(app_name,"(?i)^shelter$"),"shelter_masquerade", true(),"sha256_match")
| fillnull value="unknown" user
| stats min(_time) as first_seen max(_time) as last_seen values(ioc) as ioc values(package_name) as packages values(sha256) as sha256 by device_id user
| convert ctime(first_seen) ctime(last_seen)
| table first_seen last_seen device_id user ioc packages sha256

Microsoft KQL

let ioc_hashes = dynamic(["b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501", "ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae", "4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc", "112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf", "9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611", "1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c", "0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3", "66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb", "61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc"]);
union isfuzzy=true
  (DeviceFileEvents
   | where Timestamp > ago(24h)
   | where SHA256 in (ioc_hashes) or FileName has "net.yy.vwork"
   | project Timestamp, DeviceName, DeviceId, SHA256, FileName, FolderPath, Source="DeviceFileEvents"),
  (AlertEvidence
   | where Timestamp > ago(24h)
   | where SHA256 in (ioc_hashes) or AdditionalFields has "net.yy.vwork"
   | project Timestamp, DeviceName, DeviceId, SHA256, FileName, FolderPath, Source="AlertEvidence")
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Sources=make_set(Source) by DeviceName, DeviceId, SHA256, FileName

Sigma

title: Gigabud / Vwork Android Package Install or dpt-shell Packer Artifact
id: 5c1e7a52-3b1d-4f0e-9a41-6d2f8e7b1a01
status: experimental
description: Detects installation or loading of the Vwork Shelter fork (net.yy.vwork) delivered by the Gigabud banking trojan, a Shelter-named app with a non-upstream package, or dpt-shell packer artifacts used by Gigabud and Vwork (TL-2026-4746).
references:
    - https://www.group-ib.com/blog/vwork-app-cloning-gigabud-goldfactory/
    - https://github.com/PeterCxy/Shelter
author: Threadlinqs Team
date: 2026/10/29
tags:
    - attack.initial-access
    - attack.t1660
    - attack.command-and-control
    - attack.t1544
    - attack.defense-evasion
    - attack.t1406.002
    - attack.t1655.001
    - attack.goldfactory
logsource:
    product: android
    service: logcat
detection:
    selection_vwork:
        Message|contains: 'net.yy.vwork'
    selection_pm:
        Message|contains:
            - 'PackageManager'
            - 'installPackage'
            - 'Installing'
    selection_dpt:
        Message|contains: 'libdpt.so'
    selection_shelter_fake:
        Message|contains: 'Shelter'
    filter_upstream_shelter:
        Message|contains: 'net.typeblog.shelter'
    condition: (selection_vwork and selection_pm) or selection_dpt or (selection_shelter_fake and selection_pm and not filter_upstream_shelter)
falsepositives:
    - Security researchers analysing the Vwork or Gigabud samples on test devices
    - Legitimate dpt-shell protected apps from other vendors
level: high

Known false positives:

  • Security researchers or MTD vendors that install the Vwork or Gigabud samples on lab devices
  • A legitimately sideloaded Shelter fork renamed by a user

Tuning notes: Map index=mobile and the sourcetype to your MDM/MTD app-inventory feed and field names (package_name, app_name, sha256, device_id, user). Exclude lab device groups. Extend the hash list as new samples are published.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Gigabud/Vwork Hash or Package Observed in Defender Telemetry · unlock with TL Creds
  • Vwork Install Followed by App Install and Work Profile Provisioning · unlock with TL Creds
  • Android Device Connecting to Gigabud C2 and Streaming Ports · unlock with TL Creds
  • Sigma: Gigabud/Vwork Package Install and dpt-shell Artifacts · unlock with TL Creds
  • Sigma: Vwork Work Profile Provisioning and Gigabud Clone Commands · unlock with TL Creds
  • Sigma: Gigabud Non-Standard C2 and Streaming Ports · unlock with TL Creds
  • Banking App Duplicated into Work Profile on Personal Android Device (Vwork Cloning) · unlock with TL Creds
  • Gigabud C2 and Screen Streaming over Ports 9000, 8888 and 1935 · unlock with TL Creds

Indicators of compromise

As of 2026-10-29, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-4746.

Sample indicators (3 of 15)

  • File hash: b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501
  • File hash: ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae
  • File hash: 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

15 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Group-IB attributes Gigabud and Vwork to GoldFactory; in Indonesia (Feb-Jul 2026) it observed approximately 1,469 compromised devices, 1,281 potentially compromised logins and an estimated USD 960,939 in losses.

Vwork (package net.yy.vwork) is a weaponized fork of Shelter, a GPL-3.0 open-source Android app that uses the unprivileged Work Profile APIs to run isolated or duplicate copies of apps. Group-IB found Vwork during its 'Hook for Gold' research into GoldFactory and assesses it as an add-on module for the Gigabud Android banking trojan (active since 2022). Gigabud lists the Vwork package in its manifest queries element, and Group-IB observed on Indonesian devices that Gigabud was installed first, Vwork within minutes, then a tampered banking app.

Vwork modifications: it removes Shelter's cross-profile intent signature restrictions, exposes the cloning functions as APIs that a third-party app (Gigabud) can drive, enables sideloading while restricting Accessibility in the provisioned profile, and adds two new exported components for work profile provisioning, app cloning, listing cloned apps and launching arbitrary apps. It has a Chinese-language UI, hides its launcher icon (still visible in a file manager) and needs an authorization token from an external server before it will clone apps. Gigabud and Vwork are both packed with the dpt-shell packer.

Gigabud-side changes: new C2 commands initVwa, cloneApp and uploadCloneApps, dedicated Vwork branches in the openAPPList command, 'vwa-' prefixing of package names in C2 messages, and retrieval of the Vwork authorization token from the exfiltration server. C2 traffic is HTTPS on non-standard port 9000, video streaming uses WebSocket (port 8888) and RTMP, and C2 payloads/commands are protected with AES-ECB.

Infection chain: victims receive fake apps (impersonating airlines, tax authorities and government services) via phishing sites, messenger apps, social media, SMS and voice-call social engineering, outside official stores. The app requests Accessibility, draw-over-apps and battery-optimization exemption, sends an app inventory, shows a fake login overlay to steal credentials and an invisible overlay to capture the lock-screen PIN. The operator then has Gigabud install Vwork, which creates the work profile and clones the target banking app; the operator executes remote transactions from the cloned app in the isolated profile while a black screen conceals the activity. Because the cloned banking app runs in an isolated profile with no other user apps, the banking app's own malware checks do not see Gigabud and fraud looks unrelated to the infected device.

Impact: Group-IB observed approximately 1,469 compromised devices, 1,281 potentially compromised logins and about USD 960,939 estimated losses in Indonesia between February and July 2026. Gigabud samples configured for Vwork target Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, Philippines, Thailand, Turkiye and a GCC member state, though only the Indonesian infection chain is confirmed. Attribution to GoldFactory rests on overlapping network indicators, Chinese-language developer logs, dedicated Gigabud code branches and Vwork's exclusive appearance within the 'Hook for Gold' campaign. No CVE is involved; the abuse is of legitimate Android Work Profile functionality. No network IOCs (domains/IPs) were published in the report, so no BeaconBeagle correlation was possible.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1406.002 Software Packing; T1516 Input Injection; T1628.001 Suppress Application Icon; T1655.001 Match Legitimate Name or Location

Credential Access

T1417.002 GUI Input Capture; T1453 Abuse Accessibility Features

Discovery

T1418 Software Discovery

Command and Control

T1437.001 Web Protocols; T1521.001 Symmetric Cryptography; T1544 Ingress Tool Transfer

Collection

T1513 Screen Capture

Initial Access

T1660 Phishing

Remediation

Immediate actions

  • Hunt for and block the published Gigabud, Vwork and tampered banking app SHA256 hashes and package net.yy.vwork in MDM/EDR and mobile threat defense
  • Flag devices with an unexpected work profile on non-corporate devices or identical banking apps installed in two profiles
  • Block or step-up authenticate banking sessions from devices with non-accessibility apps holding Accessibility access

Workarounds

  • Install apps only from official stores
  • Deny Accessibility, device administrator and draw-over-apps permissions to apps that do not need them

Longer-term hardening

  • Bind banking logins to trusted devices and monitor unusual session action timing and ordering
  • Deploy behavioral mobile detection alongside signature-based detection
  • Use non-SMS second factors for banking and crypto accounts
  • Run public awareness campaigns against APK files shared through chat apps

Affected and fixed versions

  • Google — Android (devices supporting Work Profile; banking apps cloned in Indonesia and other targeted countries)
    Vulnerable versions: Devices that sideload Gigabud and grant Accessibility access

Timeline

  • Gigabud Android RAT active in the wild since at least July 2022 (month-level precision per Group-IB reporting).
  • Cyble publishes first public report on Gigabud RAT, named after the app certificate issuer (month-level precision).
  • GoldFactory begins distributing modified banking applications acting as a conduit for Android malware (observed since October 2024; month-level precision).
  • Group-IB reports GoldFactory's Southeast Asia campaign, during whose research Vwork was later discovered (month-level precision).
  • Start of the Feb-Jul 2026 window in which Group-IB observed Gigabud/Vwork fraud in Indonesia (month-level precision).
  • End of the Indonesian observation window: approx. 1,469 compromised devices, 1,281 potentially compromised logins, est. USD 960,939 losses (July 2026; month-level precision).
  • Group-IB publishes 'Vwork: Weaponized Open-source Software as an Addon for Gigabud', attributing Gigabud and Vwork to GoldFactory.

Sources cited

More from GoldFactory

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats