As reported by Infosecurity Magazine, the Gigabud Android banking trojan has been updated with a new capability to clone banking applications into a separate Android work profile, creating a significant challenge for fraud detection systems.Researchers at Group-IB have identified that Gigabud is now being paired with Vwork, a modified version of the Shelter app, attributed to the GoldFactory threat group. This combination allows Gigabud to clone legitimate banking apps into an isolated work profile on an Android device. This technique circumvents security measures because malware alerts generated in the user's personal profile are not visible in the newly created work profile. Fraudsters can then conduct transactions from this isolated environment, making the activity appear to originate from a device with no prior malware history.Fake login screens are used to steal credentials, and overlays capture one-time passcodes. The full infection chain has been confirmed in Indonesia, targeting 11 countries including Brazil, Colombia, and Mexico. Group-IB observed significant losses in Indonesia, with approximately $960,939 estimated between February and July 2026. Gigabud typically spreads through phishing sites and social media, masquerading as legitimate applications. To combat this, Group-IB advises banks to monitor for unusual work profile creation, matching banking app markers across profiles, and excessive accessibility permissions. They also recommend device binding and encouraging users to download apps only from official stores.Source: Infosecurity Magazine
