Group-IB has documented a new technique from GoldFactory, the group behind the Gigabud banking trojan, and it is one of the more elegant abuses of a legitimate Android feature published this year.

Gigabud installs a second app, Vwork, which creates an Android work profile on the victim's phone and clones a banking app into it. Then the operator moves the victim's money from inside that profile.

The clever part is not hiding from the victim. It is hiding from the bank.

What a work profile is for

A work profile is the mechanism Android uses so one phone can serve two masters. An employer's apps live inside it; the owner's personal apps live outside it. The two sides are deliberately walled off, so the company cannot see the employee's personal data and personal apps cannot reach corporate ones.

Any app can start the setup, and Android explains what a work profile is before one is created. Vwork is a fork of the open-source cloning tool Shelter — but where Shelter walks a user through several screens, Vwork reduces it to a single prompt, in Chinese: "Welcome to Vwork. Tap 'Activate now' and it will guide you through setting up the work profile."

How the wall gets used

The chain, as Group-IB lays it out:

  • Victims install a fake app posing as a national airline, a tax office or a government portal.
  • It asks for Accessibility access, which hands the operator live read, tap and type control of the screen.
  • An overlay presents a fake login over the real banking app and captures the credentials. A second overlay, invisible to the user, captures the phone's lock-screen code.
  • Gigabud instructs Vwork to clone a specific app into the hidden work profile — in one confirmed case, a fake version of a real Indonesian bank's app.
  • The operator runs the transaction through Accessibility while a black screen covers what is happening.

Why the bank's defences were looking the wrong way

Here is the mechanism that makes this worth writing about.

Banking apps increasingly carry their own malware detection. Group-IB's explanation of why that stops working: "Applications installed in one Android profile are generally isolated from those in another profile, especially for signature-based malware detection."

Picture both sides. In the personal profile, the bank's real app is present, and so is Gigabud. The bank's check does its job and flags the infection. In the work profile, a copy of the banking app runs with no trojan beside it, because the trojan is on the other side of the wall.

Group-IB describes what the bank then sees: "From the bank's perspective, the transaction originates from a new device and may appear unrelated to the previously detected malware activity. Meanwhile, the malware detection alert has already been triggered in the victim's personal profile but will not fire in the newly created work profile due to a lack of infection signals."

The detection worked. It fired on the side where nothing was lost, so it may prompt no action at all. The loss happened on the side that looked clean.

Android built that wall to protect an employee's privacy from an employer. Gigabud puts the bank where the employer would be, and the wall protects the malware from the bank. NFC relay fraud on Android abused a payment path; this abuses the phone's own rules about which apps are allowed to see each other.

The scale, with Group-IB's own caveat

The confirmed chain is in Indonesia, between February and July 2026:

  • About 1,469 compromised devices
  • 1,281 potentially compromised logins
  • Estimated losses of 960,939 dollars

Group-IB says these figures "should be considered indicative rather than representative." Samples compatible with Vwork targeted Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye and one Gulf state, but Vwork itself has been seen in the wild only in the Indonesian campaign.

Attribution to GoldFactory rests on code references to Gigabud package names, overlapping network indicators and developer logs written in Chinese.

What to do

If you run a bank or wallet:

  • Tie sessions to a trusted device, and treat a work profile appearing on a non-enterprise phone as a risk signal in its own right.
  • Link sessions server-side. The same account arriving from a "new device" on the same network shortly after a malware alert is not a new customer.
  • Block transactions from devices with active Accessibility access granted to an unrecognised app, as Group-IB recommends.

If you are a user:

  • Install apps only from official stores. Every step in this chain starts with a sideloaded fake.
  • Refuse Accessibility access to anything that is not genuinely an accessibility tool.
  • Use a second factor that is not SMS for banking and crypto.
  • If a work profile appears that no employer created, remove it.

What is not established

  • Whether Google Play Protect or Android itself flags a third-party app creating a work profile. Group-IB does not address it.
  • Losses outside Indonesia, where only samples have been found.
  • Which banks were impersonated or cloned, beyond "a real Indonesian bank".
  • Whether any bank's fraud engine already links a work-profile instance back to an earlier detection on the same handset.