A recent report by security firm **Group-IB**, published on September 9, details a significant escalation in the tactics employed by the **Gigabud** banking trojan. The malware now installs a second Android application, dubbed **Vwork**, which leverages Android's work profile feature to conceal its malicious activities.  ### The Work Profile Deception Android's work profile functionality is designed to create a separate, isolated space for employer-managed applications, keeping them distinct from personal data and apps. **Group-IB** discovered that **Gigabud** exploits this separation to its advantage. By dropping a tampered banking app within this work profile, the trojan effectively hides from the banking app's internal malware detection mechanisms. This allows fraudulent transactions to appear legitimate, circumventing alerts that might otherwise be triggered. **Group-IB** has confirmed the full attack chain on infected devices in Indonesia. ### How Gigabud Operates **Gigabud**, identified as a remote access trojan (RAT), has been active since 2022 and is linked to a threat group known as **GoldFactory**. It typically infiltrates devices via fake applications masquerading as national airlines, tax offices, or government portals, installed from outside official app stores. Upon initial launch, **Gigabud** requests critical permissions: Accessibility access, permission to draw over other apps, and background execution. Granting Accessibility access is particularly perilous, as it provides the attacker with live control over the device. The trojan then compiles a list of all installed applications, enabling the attackers to identify banking targets. When a victim opens their legitimate banking app, a convincing fake login screen overlays the real one, capturing credentials. An additional, invisible overlay captures the phone's lock screen code. Attackers can then initiate transactions on the victim's phone using Accessibility services, often obscuring the screen with a black overlay to hide their actions. ### The Role of Vwork The second application, **Vwork**, shares architectural and class name similarities with **Shelter**, an open-source tool that utilizes Android's work profile feature for app isolation or duplication. However, the critical distinction lies in control: **Shelter** is user-driven, while **Vwork** is manipulated by other applications. **Vwork** is designed to programmatically set up a work profile, clone applications into it, list its contents, and launch apps within it. **Group-IB** noted that the security checks preventing other apps from calling these functions have been removed in **Vwork**, allowing any app on the device to control it. Before cloning, **Vwork** seeks permission from an external server, and **Gigabud** contains specific commands tailored for **Vwork**.  Unlike **Shelter**, which guides users through multiple setup screens, **Vwork** streamlines the process to a single prompt, reportedly in Chinese. In confirmed Indonesian infections, **Gigabud** was installed first, followed by **Vwork** within minutes, and then the tampered banking app. Intriguingly, in the detailed case described, the app cloned into the profile was not a duplicate of the victim's own banking app but a fake version of a real Indonesian bank's application. **Group-IB**'s analysis of a single **Vwork** sample suggests it is still under active development, with some functions exhibiting instability on certain Android builds. While the report doesn't specify compatible phones or Android versions, **Gigabud** samples designed for **Vwork** have been observed targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and an unnamed Gulf Cooperation Council country. However, only the Indonesian attack chain has been fully confirmed. ### Scale of the Threat Between February and July 2026 (likely a typo, intended for 2023), **Group-IB** observed approximately 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses reaching around $960,000. These figures represent **Group-IB**'s direct observations and may not reflect the full scope of the compromise. The report did not specify how many of these devices had **Vwork** installed. **Group-IB** attributes both **Gigabud** and **Vwork** to **GoldFactory**, citing references to **Gigabud** package names within **Vwork**'s code, shared network indicators, and developer logs written in Chinese. Specific indicators were not published. ### Checking for a Work Profile Users and IT security professionals can check for an unauthorized work profile on Android devices. Google's official guidance outlines the process: * Navigate to **Settings** > **Passwords and accounts**. A **Work** tab will appear if a work profile exists. * Apps within a work profile are identifiable by a small briefcase badge on their icons. * To remove a work profile, go to the **Work** tab, select **Remove Work Profile**, then **Delete**. This action deletes all data stored within the profile. * Verify that the app responsible for setting up the profile is gone. **Group-IB** noted that **Vwork** conceals its icon from the app launcher but remains visible in a file manager. It's important to note that users cannot remove employer-owned profiles. The report does not clarify if deleting the profile completely mitigates the risk if **Gigabud** remains installed in the personal space.  ### Mitigation and Recommendations **Group-IB** advises users to: * Only install applications from official app stores. * Refuse Accessibility access to any app that is not a legitimate accessibility tool. * Utilize a second factor for banking apps that does not rely on SMS. For banks, tell-tale signs of compromise include: * The appearance of a work profile on a consumer device without user initiation. * The same banking app displaying installation markers in both personal and work profiles. * A work profile containing an unusual or minimal set of applications. * Accessibility services being enabled for an app without a clear functional need. This discovery of **Vwork** emerged during earlier **Group-IB** research into **GoldFactory**'s campaign of tampered banking apps in Southeast Asia, published in December 2025 (again, likely 2023). **Vwork** has only been observed in the wild within this specific campaign. The strategy of using containers to circumvent banking app defenses is not new. In 2023, **Promon** detailed **FjordPhantom**, which ran a legitimate banking app within a virtual container to manipulate its behavior. However, **Vwork** operates in a somewhat inverse manner, leveraging Android's inherent isolation features to place the trojan beyond the reach of conventional security checks, rather than breaking down inter-app barriers.