Hackers Clone Banking Apps into Hidden Android Work Profiles to Evade Fraud Detection
New Android malware campaigns leverage Gigabud RAT and Vwork app cloner to hide fraudulent banking activities by cloning apps into concealed work profiles.
A sophisticated new Android malware campaign is using a deceptive tactic to bypass fraud detection systems: cloning legitimate banking applications into hidden, isolated work profiles. This technique, detailed by Group-IB researchers, leverages the Gigabud remote-access trojan (RAT) and a modified app cloner called Vwork to create a clandestine environment for fraudulent transactions.
The attack chain begins with Gigabud, which has been active since 2022. Victims are typically lured into downloading malicious applications disguised as legitimate software, such as airline, tax, or government apps, through phishing sites, messaging apps, or social media. Once Gigabud infects a device, it requests extensive permissions, including Accessibility access, the ability to draw over other apps, and battery optimization exemptions. With these permissions, attackers gain remote control over the device, can overlay fake login screens on top of real banking applications, and capture sensitive information like screen lock codes.
Following the Gigabud infection, the attackers deploy Vwork, a tool based on the open-source Shelter app cloner. Vwork's primary function is to create a separate Android work profile on the victim's device. This work profile is isolated from the user's main personal profile, a feature designed by Google to separate work and personal data. However, attackers exploit this isolation to their advantage.
Once the work profile is established, Vwork clones a targeted banking application into this isolated environment. The cloned app may appear identical to the legitimate one, but it operates entirely within the hidden profile. This separation is crucial for evading fraud detection. Security systems that monitor the primary profile for suspicious activity or malware might not detect the fraudulent session occurring within the separate work profile.
Researchers have linked this campaign to the GoldFactory threat group and observed its activity across numerous countries, including Brazil, Colombia, Egypt, Indonesia, Mexico, and Thailand. In Indonesia alone, between February and July 2026, Group-IB observed approximately 1,469 compromised devices and 1,281 potentially compromised logins, resulting in estimated losses of around $960,939. This highlights the significant financial impact of this evolving attack vector.
The effectiveness of this method lies in its ability to present a seemingly normal banking session to the user and potentially to some security systems. By conducting transactions within the isolated work profile, attackers can mask malicious activity, making it appear as if a new, uncompromised device is initiating the transfer. The cloned app's launcher icon is often hidden, and its cloning functions can be controlled remotely by Gigabud, further obscuring the malicious operation.
To combat this threat, users are advised to download applications only from official app stores, be wary of Accessibility permission requests from non-legitimate apps, and utilize multi-factor authentication methods that do not rely solely on SMS. Banks are encouraged to strengthen their detection capabilities by looking for unusual session actions, blocking high-risk transactions, and correlating device risk signals with user behavior, especially when unexpected work profiles are created or applications are duplicated across profiles.
This campaign represents a broader trend in mobile banking fraud, where attackers combine social engineering, remote access trojans, and legitimate Android features to create complex and evasive attack chains. The tactic underscores the need for layered security approaches that go beyond simple signature-based detection and consider behavioral anomalies and the exploitation of device features.
This latest report from Infosecurity Magazine details how the Gigabud Android malware specifically utilizes app cloning to bypass fraud detection systems. The technique involves creating a separate instance of legitimate banking applications within a work profile, effectively isolating the malicious activity from security alerts and making it harder to trace fraudulent transactions back to the malware.
The Gigabud banking trojan has evolved its evasion tactics by incorporating a secondary app, dubbed Vwork, which automates the creation of Android work profiles. This new mechanism allows Gigabud to more seamlessly deploy a tampered banking application within the isolated work profile, bypassing banking app security checks more effectively than previous methods. Group-IB's analysis indicates that Vwork's architecture is derived from the open-source Shelter tool, but with malicious modifications enabling unattended operation and external server control.
This new reporting from Dark Reading details the specific threat actor, GoldFactory, behind the Android banking app-cloning campaign that leverages the Gigabud Trojan and Vwork app. It also highlights the significant financial losses, estimated at nearly $1 million, and provides a broader geographical scope for Gigabud's operations beyond Indonesia, including South Asia, the Middle East, Africa, and Latin America.
This new report from Malwarebytes Labs details how the Gigabud Android banking Trojan utilizes a modified version of the Shelter tool, dubbed Vwork, to achieve its malicious aims. Vwork enables Gigabud to remotely control the creation of hidden work profiles and clone target banking applications within them, a specific technical implementation not detailed in the previous report.