12 SEP 2026 — The Gigabud banking trojan has started using an Android feature built for employers to hide from banks. It installs a second application that creates a work profile on the phone, clones the victim's banking app into it, and transacts from the copy. Group-IB counted about 1,469 compromised devices in Indonesia between February and July, with losses estimated at around 960,000 US dollars.
What a work profile is for
Android work profiles exist so that a company can manage its applications and data on an employee's personal phone without seeing or touching the personal half. The two spaces run side by side with separate storage, separate credentials and separate app instances, and neither can read the other.
That isolation is the entire point of the feature. Without it, putting work email on a personal device would mean accepting an employer's management software alongside everything else on it.
Gigabud uses the isolation exactly as designed. It is not a bypass, an exploit or a permission the user was tricked into granting beyond the initial install. The separation that protects personal data from an employer also protects a cloned banking app from the genuine one.
Why the clone defeats the check
A banking app on Android typically runs its own integrity and environment checks. It looks for signs that the device is rooted, that an overlay is drawing on top of it, that an accessibility service is reading it, or that known malware is present.
Those checks can only see the profile the app is running in. A banking app inside a fresh work profile looks at a clean space: no malware, no overlays, no tampering, because the trojan is next door in the personal profile where the app cannot look.
From the bank's side, a payment arrives from what appears to be a new, clean device with no malware history and no prior alerts. Any fraud alert already raised against the victim's real device does not connect to it, because as far as the bank's telemetry is concerned it is a different device.
A privacy tool, forked into malware
Group-IB names the cloning component Vwork and describes it as a weaponised fork of Shelter, an open-source Android application that isolates apps in a work profile. Shelter's purpose is the opposite of this one: it exists so that privacy-conscious users can sandbox applications they do not trust.
Both Gigabud and Vwork are attributed to GoldFactory, which Group-IB concludes developed or customised each.
There is no security failure in Shelter here and no argument against publishing such tools. The fork demonstrates a narrower and more useful point. A tool built to isolate an untrusted app from the user works just as well to isolate that app from the genuine one it impersonates. The direction of distrust is a matter of who is holding it.
The arithmetic of the Indonesian figures
Three numbers are published for Indonesia and they are more informative together than separately: about 1,469 compromised devices, about 1,281 possibly compromised logins, and roughly 960,000 US dollars in estimated losses over six months.
Dividing the losses by the devices gives an average near 650 dollars each, and that figure characterises the operation. The campaign is not hunting large balances but running volume fraud against ordinary consumer accounts, at an amount per victim that is ruinous to a household and unremarkable to a fraud desk.
The second ratio gets less attention. There are fewer possibly compromised logins than compromised devices, so roughly one in eight infected phones did not yield a usable credential in the observation window. Infection and theft are separate events here, and the gap between them is where a bank's own controls, or simple inactivity, still made a difference.
Both readings depend on Group-IB's counts being of the same population over the same period, which the research implies but does not state outright. We have treated the division as indicative rather than precise.
Where it is operating
Samples built to work with Vwork have been found aimed at Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye and one Gulf Cooperation Council state Group-IB does not name.
Four of those eleven are ASEAN members, and the only country for which loss figures have been published is Indonesia. The research does not establish whether the campaign is heaviest in Indonesia or whether Group-IB simply had the best visibility there. Nobody should infer that Indonesia is worst affected merely because it is the only country with a published figure.
The regional fit follows from how these markets bank. They are Android-dominant, mobile banking is the primary channel rather than a convenience, and on a mid-range phone the bank app is the account, not a view of it.
What a user can actually do
Check whether a work profile exists that should not. On most Android builds, work-profile apps are marked with a small briefcase badge on the icon, and there is a separate work tab or section in the app drawer. A personal phone that has never been enrolled with an employer should have neither.
If one is there and its origin is unexplained, the removal path is the device's own settings rather than an antivirus scan — the profile is a managed container, and deleting it removes everything inside it. Contact the bank before or immediately after, because the fraudulent device is the clone, not the phone.
The prevention that matters is upstream and unglamorous. Gigabud arrives as an install, which means something was sideloaded or came from outside the official store. The trojan's cleverness begins only after the user has granted it that first installation.
What to watch
Whether banks change what they check. The technique defeats client-side integrity checking specifically, and defeats it by construction rather than by staying ahead of it — a better on-device check cannot see into another profile. The countermeasure has to be server-side, based on behavioural signals from the account rather than the device.
And whether the technique spreads. It is simple, it uses a documented platform feature, and the tooling is a fork of published code. Nothing about it is exclusive to GoldFactory, and capabilities with those three properties have historically become common.
View author profile → · Editorial policy
