Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
Summary: Group-IB reported on September 9 that the Gigabud banking trojan now installs a second Android app called Vwork, which creates a work profile on the infected phone and drops a tampered banking app inside it, hiding the trojan from the banking app's malware checks. Group-IB confirmed the full chain on infected devices in Indonesia, where it counted about 1,469 compromised devices and 1,281 possibly compromised logins between February and July 2026, with estimated losses of about $960,000.
Why it matters: The technique turns a containment boundary Android built for employers into a blind spot: a banking app scanning from inside a work profile cannot see the trojan in the personal space, and Group-IB's report does not say whether deleting the profile ends the risk while Gigabud remains installed. Group-IB's own detection signs are behavioral - an unexplained work profile on a consumer phone, a banking app with install markers in both profiles - which means file-based malware checks will not surface it.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026