Gigabud Trojan Leverages Vwork App Cloning for Fraud Evasion

• •Gigabud now uses Vwork to clone banking apps into isolated Android work profiles.
• •Fraudulent transactions are obscured from detection, leading to significant financial losses.
• •Group-IB identified 1469 compromised devices in Indonesia with estimated losses of $960,939.

The Gigabud Android banking trojan has been enhanced with Vwork, a modified version of the Shelter app, allowing it to clone banking applications into a separate Android work profile. This technique helps fraudsters evade detection by isolating malware alerts from fraudulent transactions. Group-IB's research indicates that this combination has been confirmed on devices in Indonesia and is targeting 11 countries, including Brazil, Colombia, and Mexico. Between February and July 2026, approximately $960,939 in losses were reported due to this malware. Gigabud typically spreads through phishing sites and social media, masquerading as legitimate applications. The malware requests various permissions to gain control over the device, including accessibility access. Group-IB has identified specific behavioral signals for banks to monitor, such as unusual work profile creation and excessive accessibility permissions. The threat is attributed to the GoldFactory group, which has been active since 2022.