Gigabud Malware Abuses Android Work Profiles and Vwork App Cloning for Defense Evasion

The campaign shows how threat actors can abuse Android Work Profiles to separate malicious activity from the victim’s normal phone environment and evade banking-app security checks.

Gigabud has been active since 2022 and is linked by Group-IB to the GoldFactory threat group. It targets users across Southeast Asia, South Asia, the Middle East, Africa, and Latin America.

The malware commonly arrives through phishing websites, messaging apps, and social-media posts that distribute fake applications impersonating airlines, tax agencies, government services, or other trusted brands.

After installation, Gigabud requests Accessibility permissions, overlay access, and battery-optimization exemptions. If the victim grants Accessibility access, attackers can remotely view, tap, type, and control the infected device.

The trojan can also inventory installed apps, display fake banking-login overlays, capture credentials and lock-screen codes, and hide fraudulent activity behind a black screen.

Gigabud Exploits Android Work Profiles

Vwork is a weaponized fork of Shelter, an open-source Android tool designed to create and manage isolated Work Profile spaces. Normally, Android Work Profiles separate work-related apps and data from a user’s personal profile.

However, Vwork changes this model by exposing cloning and application-management functions through an API that other apps can control.

Unlike Shelter, Vwork removes several safeguards that require direct user interaction. It enables third-party applications to provision a work profile, clone apps, list cloned apps, and open applications inside the isolated environment.

Its launcher icon is hidden, its interface is reduced, and many settings are delegated to the external application controlling it.

Group-IB observed Vwork being installed shortly after Gigabud infections, followed by tampered banking applications.

Gigabud samples contain the Vwork package name, net.yy.vwork, and include dedicated command-and-control commands such as initVwa, cloneApp, and uploadCloneApps.

These commands allow Gigabud operators to communicate with Vwork, obtain authorization tokens, and clone selected banking apps into the newly created Work Profile.

The technique is significant because apps in Android’s personal and Work Profiles are generally treated as separate environments.

A bank’s security SDK may detect malicious behavior in the personal profile, but the same alert may not apply when a banking app is launched from a clean Work Profile created later.

Attackers first use Gigabud in the victim’s personal profile to gain control and collect credentials.

They then deploy Vwork, create an isolated profile, and clone a targeted banking application into it. In one confirmed Indonesian case, the cloned app was a fake version of a legitimate bank application, Group-IB said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC

The post Gigabud Malware Abuses Android Work Profiles and Vwork App Cloning for Defense Evasion appeared first on Cyber Security News.