Gigabud Uses Android App Cloning to Evade Fraud Detection

Group-IB reports that the Gigabud Android banking trojan has been combined with Vwork (a weaponized fork of the Shelter app) to clone victim banking apps into Android work profiles, allowing operators to hide fraudulent transactions and evade detection; the activity is attributed to 'GoldFactory', observed in Indonesia with samples targeting 11 countries, and resulted in hundreds of compromised devices and an estimated loss of roughly $960,939, while Group-IB provides behavioral signals and mitigation advice for banks and users.