Android has a feature that keeps work apps walled off from personal ones. A banking trojan has started using that wall the other way round, to hide from the bank.
Researchers at Group-IB noticed an app called Vwork installing itself within minutes of a Gigabud infection, alongside tampered banking apps, during their Hook for Gold investigation. Chasing a sample led them back to Gigabud builds that were deliberately written to talk to Vwork, which ruled out coincidence. The findings are published in Group-IB's research on the pairing.
A privacy tool turned inside out
Vwork is a fork of Shelter, a legitimate open-source Android app that uses the built-in Work Profile feature to run a second, isolated copy of an application. Shelter is meant to be driven by the phone's owner, by hand. Vwork exposes the same controls as an API, so another app on the device can order cloning and app management without anybody touching the screen. It has no command-and-control channel of its own, which is why it never appears alone. It needs a partner already on the phone.
That partner is Gigabud, an Android remote access banking trojan active since 2022 that Group-IB attributes to the GoldFactory group. It is delivered by sideloading, through phishing sites, messenger apps and social media, wearing the branding of a national airline, a tax authority or a government portal depending on the region. On first launch it asks for Accessibility permissions, the right to draw over other apps, and an exemption from battery saving. Granting Accessibility is the moment the operator gains real control. Gigabud then ships back a full list of installed apps so the operator can pick which banks to target, and waits for instructions.
Why a second profile beats the bank's own checks
Credential theft comes first, and it is conventional: when the victim opens their real banking app, a fake login screen appears on top and captures what is typed, while a separate invisible overlay records the phone's lock screen code. The new part is what happens next. The operator tells Gigabud to install Vwork, then sends Vwork a command to clone a chosen app into the hidden work area. In one confirmed case observed by Group-IB, the copy was a fake version of a real Indonesian bank's application.
Apps in one Android profile are largely isolated from those in another, and that isolation includes the signature-based detection that banking apps run through their own security SDKs. Malware sitting in the personal profile is invisible to a banking app running in the work profile. If the cloned environment goes undetected, Group-IB says, fraudulent transactions may bypass monitoring entirely and reach cash-out. The operator carries them out on the victim's own handset, with a black screen covering what is happening, which is the same on-device fraud model we saw when ToxicPanda moved its transactions onto the victim's phone.
Nearly a million dollars in six months
In Indonesia alone, between February and July 2026, Group-IB observed roughly 1,469 compromised devices and 1,281 potentially compromised logins, with estimated losses of about $960,939. The researchers stress these are observed figures and should be read as indicative rather than as the full regional picture. Gigabud builds carrying Vwork support have been found targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Turkiye and one GCC member state. Our Indonesia country profile tracks the wider picture there.
The whole attack still starts with a sideload
Nothing here defeats Google Play. Every infection begins with an app installed from outside the official store, and the pivot point is Accessibility. Treat any app that demands Accessibility permission to function as hostile unless it is a genuine assistive tool, and check Settings for a work profile you did not create. Banks and fraud teams should stop treating device-side integrity checks as sufficient on their own, because this technique is designed specifically to run beneath them. Dropper apps that do reach the store are a separate problem, and one we covered last month.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.