The cybersecurity company said Gigabud is being paired with Vwork, a modified fork of the open-source Android application Shelter, to create a separate Work Profile and place banking applications inside it. Group-IB attributed both Gigabud and Vwork to the financially motivated threat group it tracks as GoldFactory.
Android Work Profiles are designed to separate work applications and data from a user’s personal environment. Group-IB said the attackers are exploiting that separation so malware operating in the personal profile can remain outside the view of security checks running within a cloned or tampered banking application placed in the work profile.
The technique can weaken a bank’s ability to connect an earlier malware detection with a later transaction from the same physical phone. A payment initiated through the isolated profile may appear to come from a different or previously unseen environment, complicating device-risk assessments and fraud monitoring.
Researchers confirmed the complete infection chain on devices in Indonesia. They also identified Gigabud samples containing code designed to interact with Vwork and targeting 11 countries: Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye and one unnamed Gulf Cooperation Council country. Group-IB did not say that Vwork infections had been confirmed across all 11 markets.
Vwork is based on Shelter, a legitimate free and open-source application that uses Android’s Work Profile feature to isolate or duplicate apps. Shelter’s published documentation says it can install applications in an isolated profile and run two copies of the same app on one device.
Group-IB said Vwork changes that model by exposing cloning functions so another application can control them. Gigabud contains dedicated commands to provision a work profile, clone a selected application and report which applications have been copied. Vwork also contacts an external authorisation server before cloning proceeds.
Unlike Shelter, which is intended to be operated by the device owner, Vwork allows Gigabud to automate profile management. Group-IB said this relationship was reinforced by code references, network indicators and Gigabud builds engineered to communicate with Vwork.
The researchers said Vwork removes restrictions that would ordinarily prevent other applications from invoking Shelter-style functions directly. Its setup flow is also shortened, reducing the user interaction required to establish the separate profile. Group-IB found Chinese-language elements in the software and other technical links that it said supported its attribution to GoldFactory.
Gigabud itself functions as a remote-access banking trojan. Once installed, it can seek Android Accessibility permissions, display overlays, collect information about installed applications and give operators control over actions on the infected device. Group-IB said fake login interfaces can be used to capture banking credentials, while an additional overlay may obtain the device lock-screen code.
The malware can then support transactions carried out under remote control while obscuring activity from the victim. By shifting the banking application into a Work Profile, the attackers add another layer intended to separate the transaction environment from the profile where the original malicious application was detected.
Group-IB said it observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia between February and July 2026, with estimated losses of about $960,000. Those figures reflect activity visible to the company’s systems and were not presented as nationwide totals. The company did not specify how many of those devices were running Vwork.
The findings extend Group-IB’s earlier research into GoldFactory, a financially motivated, Chinese-speaking cybercrime operation associated with several mobile banking malware families. Its campaigns have used fake applications impersonating airlines, tax authorities and government services to persuade victims to install software outside official app stores.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
