Android malware operators behind Gigabud have developed a sneaky new trick: they’re creating work profiles on compromised phones to hide malicious activity from banking apps’ protection checks. Security researchers have confirmed this tactic is active, with full infection chains observed in Indonesia. The Trojan installs a separate app dubbed “Vwork” inside the work profile and drops a tampered banking app there—keeping the malware in the personal profile out of reach of the banking app’s scans.
How It Works
Gigabud is a remote access trojan (RAT) that’s plagued Android devices since 2022. It often disguises itself as legitimate applications—government portals, airlines, tax offices—and spreads outside official app stores. Once run, it demands Accessibility access, draw-over-apps permission, and background execution privileges. With these, Gigabud can monitor installed apps, detect when a real banking app opens, overlay a fake login screen to steal credentials, and even capture lock screen PINs via invisible overlays.
The new wrinkle: Vwork. It mirrors features of an open-source utility called Shelter, which is used to create work profiles to isolate apps. But unlike Shelter—controlled by the user—Vwork is commanded remotely by Gigabud. It quickly sets up a work profile, clones the banking app into that space, then runs malicious overlays from there. Because Android’s security model treats work profiles separately, the banking app’s built-in malware checks, which run in the main profile, can’t reach into the work profile to detect threats.
Where It’s Happening & Impact
So far, the full infection chain has only been confirmed in Indonesia. Researchers counted roughly 1,469 devices compromised between February and July 2026, and 1,281 possibly compromised logins—total losses estimated at around US$960,000. While versions of Gigabud using Vwork have been found in many regions including Brazil, Mexico, Southeast Asia, North Africa, and the Gulf, most are not yet confirmed as live infections.
Vwork is still under development, and some features glitch on phones running Android builds close to the pure open-source version. It’s unclear which Android versions or models are universally vulnerable to this scheme. Meanwhile, the social engineering component is in Chinese: when cloning the banking app, Vwork uses minimal prompts (often just a single screen in Chinese), eliminating many of the barriers users would normally see when installing a work profile manually.
How to Spot & Protect Yourself
Users should watch for unusual behavior: a work profile showing up without your input, duplicate instances of banking apps (one in main profile, one in work profile), or strange apps requesting Accessibility access that don’t clearly need it. If you find a work profile you didn’t create, Android’s settings let you delete it—checking under “Passwords & accounts” for a “Work” tab. Removing the profile also purges the apps stored inside it. However, deleting the work profile doesn’t necessarily remove Gigabud, which often remains in the personal space.
Security pros recommend installing apps only from trusted stores, refusing Accessibility access unless it’s essential, and using secondary authentication methods for banking—ideally not SMS-based. Banks should also monitor for anomalous factors such as app icon duplication across profiles or features normally available only for device management being present on consumer phones.
Gigabud and Vwork are tied to a group known as GoldFactory. Researchers point to shared code elements, package naming conventions, and Chinese-language logs that link the two. Vwork was previously seen during a campaign targeting tampered banking apps in Southeast Asia at the end of 2025.
What This Means
This development shows malware isn’t just trying to bypass technical defenses—it’s redefining how it dodges checks by exploiting Android’s built-in compartmentalization. By leveraging work profiles, attackers are splitting personal and work spaces to insulate malicious software. That substantially raises the bar for detection: security checks that only inspect the main profile are now blind to threats inside work profiles. Going forward, both app developers and OS makers will need to adapt threat models to account for cross-profile abuse. Users have a role too—better permission hygiene, multiple authentication layers, and skepticism toward unfamiliar profile creation could help close this gap.
