Group-IB observed about 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia between February and July 2026, with estimated losses of roughly $960,939, the company reported on September 9.
Vwork and Shelter's work-profile cloning
Group-IB's analysis identifies Vwork as a weaponized fork of the open-source Android app cloning tool Shelter. Vwork leverages Android's Work Profile feature to clone apps into a separated, isolated environment. Where Shelter is intended to be controlled by the device owner, Group-IB found that Vwork exposes its cloning functions as an interface any other app on the device can call — effectively allowing a separate app to script creation and population of a work profile.
How Gigabud and Vwork operate together
The Android banking trojan Gigabud has been equipped to call Vwork's functionality. Group-IB reported that Gigabud samples include dedicated code implementing three new commands: provision the work profile, clone a named app into it, and report back what was cloned. Cloning requires a token from an external authorization server, which Gigabud retrieves as part of its workflow.
The operators’ pattern, as observed by Group-IB, is methodical. They install the malware, wait for a suitable moment, then clone the targeted banking application into the newly created work profile and perform transactions from that isolated environment. Because apps in one profile are largely invisible to signature-based detection in another, an alert raised in the personal profile does not necessarily fire in a work profile created afterwards — breaking the normal link between a prior malware detection and subsequent fraud on the account.
Group-IB also described how Gigabud captures credentials and authentication material: fake login screens collect banking credentials; a separate invisible overlay takes the lock-screen code; and during fraudulent activity a black screen conceals what is happening on the handset. On first launch, Gigabud requests accessibility access, overlay permission and a battery exemption — the accessibility permission being the mechanism by which operators gain control.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleGeography, attribution, and delivery
Group-IB attributed both Gigabud and Vwork to a group it calls GoldFactory, concluding the group had developed or customized each component. The full infection chain was confirmed only on devices in Indonesia, where the company documented the incidents and loss estimates. However, Group-IB said Gigabud samples built to work with Vwork were found targeting 11 countries in total, naming Brazil, Colombia, Egypt, Mexico, Thailand and Turkiye among them.
According to the report, Gigabud has been active since 2022 and reaches victims via phishing sites, messengers and social media, frequently masquerading as airline, tax authority or government apps.
Detection signals banks should consider
To counter the separation this attack exploits, Group-IB named six behavioral signals banks can monitor, and supplied examples banks should treat as higher risk. Those examples include: a work profile appearing on a phone the user never set up; matching banking app markers across profiles; an otherwise empty isolated environment (the cloned profile containing little other activity); and an app holding accessibility access when there is no legitimate reason for it to require that permission. “Two or more together should be treated as a high-risk session,” Group-IB said.
The firm also recommended device binding to prevent stolen logins from authorizing payments, and urged users to obtain apps only from official stores.
What this means for technologists, banks, and end users
- Technologists and security teams: watch for unexpected work-profile creation, validate tokens used for cloning flows, and flag otherwise-empty isolated environments and cross-profile app matches as anomalous behaviors.
- Banks and fraud teams: treat combinations of the named behavioral signals as high risk, consider tighter device binding for payment authorization, and factor work-profile visibility into fraud-detection logic.
- End users: install apps only from official stores and be cautious of links sent via messengers and social media that pose as airlines, tax authorities or government services — the distribution vectors Group-IB reported for Gigabud.
The technical innovation at the center of this campaign is straightforward: use Android's legitimate work-profile isolation to sever the forensic trail between an infected device and a fraudulent transaction. Group-IB's Indonesia findings — presented as indicative rather than representative — illustrate one region's quantified impact, but the underlying mechanism is portable to other markets the researchers flagged. How quickly banks and device-security teams adapt detection rules that join the dots across profiles will determine whether the gap exploited by Gigabud and Vwork becomes a persistent blind spot or a short-lived window for fraudsters.
