Android users are facing a stealthy financial threat: hackers are cloning banking apps into hidden work profiles to dodge fraud detection systems. Cybercriminals are combining overlay malware, remote access tools, and Android’s work profile system to conceal fraudulent activity behind what looks like a clean session.
Malware Routers: Gigabud and Vwork Unite
The attack sequence starts with Gigabud, a remote-access Trojan active since 2022. Victims are tricked—via phishing sites, social-media posts, or fake app installs—into downloading malicious apps such as clones of banks, airlines, or government services. Once installed, Gigabud requests Accessibility permissions, the ability to draw over other apps, and battery optimization exemptions. These authorizations give attackers nearly full remote control of the device: reading installed apps, overlaying fake login screens, capturing lock-screen PINs, and more.
Once access is secured, operators deploy Vwork, a modified version of the open-source Shelter app cloner. Vwork creates a separate work profile on the Android device and installs cloned banking apps within it—often fake versions—while staying hidden from the user’s primary profile. This split makes it harder for banks or security tools to trace fraudulent sessions back to an already flagged device, since the bank may only see a clean, new profile.
Geography, Scale & Financial Impact
Experts attribute this campaign to a threat group called GoldFactory. Their operations have targeted countries including Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and a Gulf Cooperation Council member state. The breadth of this campaign showcases how widespread the risk has become.
From February through July 2026, researchers observed roughly 1,469 compromised Android devices and 1,281 potentially compromised login sessions in Indonesia alone. Estimated financial losses across those attacks totaled almost US$1 million, underscoring both the scale and the impact of this advanced fraud method.
Signals, Defense, and Indicators of Compromise
Some signs that an attack is underway include unexpected creation of an Android work profile; having the same banking app installed in both personal and work profiles; or spotting another app installation that seems suspicious immediately following one you trust. These are red flags pointing to possible fraud lurking behind the scenes.
To defend yourself, restrict app installation to trusted sources like official stores. Be wary of requests for Accessibility permissions from apps that aren’t clearly designed for that purpose. Use non-SMS factors for banking authentication, and think twice before installing raw app files shared via chat or social media.
Institutions such as banks or digital wallet providers should tie logins to verified devices, monitor for unusual session behavior, and flag or block transactions involving apps with active Accessibility access. Behavioral detection should complement signature-based tools to catch these sophisticated multi-pronged attacks.
Analysts warn this is part of a broader evolution in mobile fraud. Instead of relying solely on phishing or remote access, attackers are exploiting Android features designed for device segmentation—features meant to protect, not deceive. Through work-profile cloning, overlays, and hidden control tools, they are blurring the line between legitimate activity and fraud.
The takeaway: a seemingly clean banking session doesn’t guarantee a safe device. Watch out for suspicious profile creation or duplicate app installs; treat active Accessibility permissions with skepticism. For security operations, linking those warning signs across profiles could lead to discovering fraudulent transfers before they occur. And for users, combining caution with stronger authentication can make all the difference.
What to watch next is how banks and platforms adapt to this threat. Can detection systems become sensitive enough to link these hidden work-profile attacks back to earlier risk signals? Will Android tighten controls around permissions to prevent misuse? The answers will define how much breathing room attackers have.
