GoldFactory Weaponizes Open

Gbhackers •Mayura Kathir • September 9, 2026

GoldFactory has expanded the evasion capabilities of its Gigabud Android banking trojan by deploying Vwork, a weaponized fork of the open-source Shelter application. The companion tool abuses Android Work Profile isolation to clone banking apps into a separate managed environment, weakening the link between malware signals detected in a victim’s personal profile and fraudulent activity […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Gigabud Trojan Leverages Vwork App Cloning for Fraud Evasion The Gigabud Android banking trojan has been enhanced with Vwork, a modified version of the Shelter app, allowing it to clone banking applications into a separate Android work profile. This technique helps fraudsters evade detection by isolating malware alerts from fraudulent transactions. Group-IB's research indicates that this combination has been confirmed on devices in Indonesia and is targeting 11 countries, including Brazil, Colombia, and Mexico. Between February and July 2026, approximately $960,939 in losses were reported due to this malware. Gigabud typically spreads through phishing sites and social media, masquerading as legitimate applications. The malware requests various permissions to gain control over the device, including accessibility access. Group-IB has identified specific behavioral signals for banks to monitor, such as unusual work profile creation and excessive accessibility permissions. The threat is attributed to the GoldFactory group, which has been active since 2022. 8 sources 70

Extracted Entities

GoldFactory Weaponizes Open

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (3)