A sophisticated Android banking trojan now clones banking apps into isolated work profiles to break the connection between malware alerts and fraudulent transactions that follow, according to research published September 9 by cybersecurity firm Group-IB. The malware, called Gigabud, operates alongside Vwork, a weaponized version of the open-source app cloning tool Shelter. Group-IB traced both tools to a threat actor named GoldFactory, determining the group had either built or customized each component.
In Indonesia between February and July 2026, Group-IB documented roughly 1,469 compromised devices and 1,281 potentially compromised logins, with estimated losses totaling approximately $960,939. The complete infection chain was verified only on Indonesian devices, though Gigabud samples designed to work with Vwork were found targeting 11 countries including Brazil, Colombia, Egypt, Mexico, Thailand and Turkey. Gigabud, which has been active since 2022, spreads through phishing websites, messaging platforms and social media by masquerading as airline, tax authority or government applications. When victims first launch the malware, it requests accessibility permissions, overlay authorization and battery exemption, with the accessibility access granting operators full control.
The cloning technique exploits Android's Work Profile feature to duplicate banking apps into a separate environment. While the legitimate Shelter app requires manual operation by the device owner, Group-IB found that Vwork exposes its cloning capabilities as an interface accessible to any other app installed on the device. Gigabud carries specialized code including three new commands that provision the profile, clone a specified app and transmit reports of what's been duplicated. The cloning process requires a token retrieved from an external authorization server, which Gigabud obtains automatically. Group-IB recommended that banks watch for six behavioral indicators, including a work profile appearing on a device the user never configured, identical banking app signatures across profiles, an otherwise empty isolated environment and accessibility permissions granted to apps with no legitimate need for them. Two or more signals occurring together should trigger treatment as a high-risk session, the firm said.
The scheme works by exploiting detection isolation: apps running in one profile remain largely invisible to signature-based security scans in another profile, meaning an alert triggered in the personal profile won't fire in a work profile created afterward. Fraudsters install the malware and wait before cloning the bank's application into the new profile and executing transactions from that isolated space. From the bank's perspective, the payment appears to originate from an unrecognized device with no malware history. Fake login screens harvest banking credentials while a separate invisible overlay captures the lock screen code, and during the actual fraud a black screen hides what's occurring on the handset. Group-IB called its loss figures indicative rather than representative of the broader region.
Group-IB advised that banks implement device binding to prevent stolen login credentials from authorizing payments, and urged users to download apps exclusively from official stores. The dual-profile attack represents a fundamental challenge for fraud detection systems that assume malware and suspicious transactions will appear on the same observable environment. Organizations relying solely on endpoint security scans may find their existing defenses systematically bypassed, requiring a shift toward behavioral monitoring that tracks anomalies across all device partitions rather than depending on signature recognition within a single profile.