Gigabud Clones Banking Apps Inside Android Work Profiles

Gigabud Clones Banking Apps Inside Android Work Profiles

Indonesia has become the testing ground for a banking-trojan technique that weaponises one of Android's most trusted enterprise features. The Group-IB research published on September 9 describes how the GoldFactory threat group extended the Gigabud trojan with a cloned banking app sitting inside a hidden Android Work Profile — an isolated environment where the malware detection in the personal profile simply doesn't follow.

From Group-IB's Indonesia telemetry between February and July 2026: roughly 1,469 compromised devices and 1,281 potentially compromised logins, with an estimated loss of just under USD $1 million. The firm is careful to call these figures indicative rather than representative of the full regional impact.

The play: split the fraud across two profiles

Android's Work Profile is designed for the enterprise — it carves out a separate, isolated space on a personal phone where work apps live independently. Isolation is the whole point. Group-IB showed that GoldFactory weaponises that isolation to break the link between a malware detection and a fraudulent transaction.

The infection chain goes like this:

1. The victim installs a fake app — disguised as a national airline, tax authority, or government portal — outside the official app store, thinking it's legitimate. It's Gigabud.
2. On first launch, Gigabud asks for Accessibility access, permission to draw over other apps, and an exemption from battery saving. Granting Accessibility hands the operator live remote control of the phone.
3. Gigabud sends the operator a full inventory of installed apps, then opens a live connection and waits for instructions.
4. When the victim opens the real banking app, a fake login screen captures whatever is typed; a separate invisible overlay also captures the lock-screen code.
5. The operator tells Gigabud to install Vwork, which creates a work profile and clones the banking app into it. In one confirmed case, the copy was a fake version of a real Indonesian bank's app.
6. The operator carries out transactions directly on the victim's phone — behind a black screen — using the cloned app inside the work profile.

The reason this works is the profile boundary itself. From the bank's perspective, the transaction originates from a new device and may appear unrelated to the malware that was already flagged in the personal profile. Meanwhile the detection alert fires in the personal profile but not in the freshly created work profile, because the fraud environment carries no infection signals. The detection and the cash-out get deliberately uncoupled.

Vwork: open source, repurposed

The build that makes all this possible is Vwork — a fork of Shelter, the well-known open-source app-cloning tool. Shelter is a legitimate device-owner utility: it manually moves apps into a work profile. Vwork changes the trust model. Its capabilities are exposed as an API so a third-party app (Gigabud) can drive cloning, provisioning, and app management remotely.

The key deliberate differences Group-IB identified:

• Cross-profile intent signatures from upstream Shelter are removed, so any app can interact with Vwork.
• Read/write file capability is exposed to any application in the same profile.
• Vwork ensures sideloading is allowed and Accessibility is restricted inside the provisioned profile — hiding cloned apps from its own footprint.
• Two new exported components expose four actions: start work-profile provisioning, clone applications, list cloned applications, and open an arbitrary app.
• Cloning is token-gated — it requires authorisation from an external server, with the server address and token supplied by Gigabud.

Vwork carries no command-and-control of its own. It receives commands through Gigabud as a proxy, which is partly why it slips under app-analysis radar: the cloner looks like an isolated utility, and the trojan drives it like a puppet. The new Gigabud C2 commands are telling:

# Gigabud C2 commands that drive Vwork (per Group-IB)
initVwa          # provision a work profile on the device
cloneApp         # clone a target package into the profile (token-gated)
uploadCloneApps  # report which apps were cloned back to C2

By default Gigabud also hides Vwork's launcher icon, and the UI is localised to Chinese. The profile it provisions is rebranded "work profile" → "virtual space" — a detail designed so a victim who stumbles across the screen reads the wrong mental model.

Region-wide scope, Indonesia in the crosshairs

Vwork-compatible Gigabud samples have been found targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, Philippines, Thailand, Türkiye, and a GCC member state. Group-IB's APAC fraud analyst Bryan Karunachandra told Dark Reading that GoldFactory has targeted around a dozen Indonesian banks, including state-owned and private institutions, in this campaign.

For Malaysian readers this is not a distant story. Indonesia runs the exact same mobile-banking software stacks — and the same social-simulation lures — that we see locally. QR-based mobile fraud already cost Malaysian users RM28.67M; the delivery lesson here is that an attractive fake app from outside the Play Store is the entry point, and the confirmation trick is the Accessibility grant.

The goldmine for Group-IB's operators is a bank with weak device-correlation: the startled-looking "new device login" that a cloned environment produces. This is why Group-IB's core recommendations to banks are device binding and blocking transactions from any device with active Accessibility access on an unrecognised app — controls that don't depend on profile-aware detection. Behavioral signals beat signature matching here, because the work profile contains none of the personal-profile infection indicators.

A separate but parallel threat is Mantax Otax, documented by Zimperium's zLabs on the same day — an aggressive banking trojan linked to Indonesian threat actors aimed at Indonesian victims. Zimperium's chief scientist Nico Chiaraviglio's framing is worth borrowing: mobile banking malware concentrates wherever mobile finance is widespread and social engineering can be localised. Indonesia is exactly that, and the same vector is permanent pressure on Malaysia.

How to spot it before the cash-out

Group-IB's earliest reliable warning sign is behavioural and it doesn't require inspecting an APK: a consumer phone that was never set up by an employer suddenly gains an isolated work profile. Other signals in the chain:

• Identical banking-app installations across more than one profile.
• An isolated work profile with none of the user's normal apps in it.
• Accessibility access enabled for an app that has no business being an accessibility tool.
• An unexpected app installation from a non-legitimate source landing shortly after another install.

For end users, the practical defaults are unchanged but worth repeating: install banking apps only from the official store, never approve Accessibility for an app that isn't an accessibility tool, and avoid SMS as your banking second factor. A cloned work profile you never asked for is an immediate stop-and-verify cue.

For developers shipping financial Android apps, the takeaway is that sandbox escapes aren't the whole mobile threat model. GoldFactory never escaped the profile barrier — it exploited the barrier itself, because the security signals your backend and an on-device SDK produce are scoped to a single profile. Profile-aware fraud correlation, device binding, and behavioural checks are the controls that actually survive this class of attack.

Sources

• Group-IB — Vwork: Weaponized Open-source Software as an Addon for Gigabud
• Dark Reading — Indonesia Hit by Android Banking App-Cloning Campaign
• Zimperium zLabs — Mantax Otax: Indonesian mobile ransomware with spyware integration