GoldFactory Weaponizes Open-Source Vwork App Cloner in Gigabud Banking Malware Attacks

GoldFactory has expanded the evasion capabilities of its Gigabud Android banking trojan by deploying Vwork, a weaponized fork of the open-source Shelter application.

The companion tool abuses Android Work Profile isolation to clone banking apps into a separate managed environment, weakening the link between malware signals detected in a victim’s personal profile and fraudulent activity performed elsewhere on the same device.

The recurring sequence, combined with Gigabud samples containing explicit Vwork interaction logic, indicates that Vwork is an operational component of GoldFactory’s mobile-fraud toolkit rather than an unrelated application.

Gigabud, active since 2022, is an Android remote-access trojan attributed by Group-IB to GoldFactory. It has been used against victims across Southeast Asia, South Asia, the Middle East, Africa, and Latin America.

Operators commonly use phishing sites, messaging platforms, social-media lures, and fraudulent calls to persuade targets to sideload APKs impersonating airlines, tax agencies, or government services.

Once installed, Gigabud requests high-risk permissions, including Accessibility access, overlay privileges, and battery-optimization exemptions.

Accessibility is particularly significant because it can enable attackers to read on-screen content, capture credentials through overlays, automate taps and gestures, unlock screens, and remotely operate the compromised handset.

GoldFactory’s broader campaigns have also used convincing fake Google Play pages and government-themed social-engineering lures to deliver malware.

Group-IB said in a report shared with GBhackers, identified Vwork during its “Hook for Gold” investigation after repeatedly observing the application installed shortly after Gigabud infections alongside tampered banking apps.

Gigabud Banking Malware

Vwork changes the fraud model by turning Android’s enterprise-oriented Work Profile feature into a device-level evasion layer.

Shelter, the upstream open-source project, is designed to let device owners manually create isolated app spaces.

Vwork retains that architectural foundation but exposes cloning and app-management functions through APIs available to other applications.

In effect, Gigabud can command Vwork to provision a profile, clone a targeted package, enumerate cloned applications, and launch applications inside the isolated environment.

The modifications are operationally important. Group-IB found that Vwork removes Shelter’s restrictions around cross-profile interaction, alters file-sharing behavior, supports sideloading, limits Accessibility service use in the provisioned profile, and hides its launcher icon.

Its setup flow is also reduced to a simplified activation prompt, while much of the configuration is delegated to an external controller rather than retained in the user interface.

Gigabud samples built to work with Vwork declare the package name net.yy.vwork and include new command-and-control functions such as initVwa, cloneApp, and uploadCloneApps.

The malware also prefixes app identifiers with vwa- in C2 communications when handling apps in the virtualized environment.

The cloning operation relies on external authorization, with Gigabud obtaining a token from its infrastructure before directing Vwork to clone a selected target package.

This separation is designed to undermine security telemetry. A bank may identify malware or suspicious Accessibility behavior in the personal profile, but subsequent transactions conducted through a newly created work-profile instance can appear to originate from a different, cleaner app environment.

In one confirmed Indonesian case, attackers cloned a fake version of a legitimate bank application after deploying Gigabud and Vwork.

Group-IB observed Gigabud variants compatible with Vwork targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and an unnamed GCC state.

In Indonesia, telemetry recorded approximately 1,469 compromised devices and 1,281 potentially compromised logins between February and July 2026, with estimated observed losses of about $960,939.

For financial institutions, detection should focus on behavior rather than a single malware signature: unexpected work-profile creation on consumer devices, duplicate banking-app installations across profiles, unusual sideloading sequences, Accessibility abuse, and a sparse work-profile environment immediately preceding high-risk transactions.

Correlating these signals can expose the profile-isolation technique before attackers complete unauthorized transfers.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.