Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

Group-IB reports that the Gigabud Android banking trojan now installs a second app, Vwork, which creates an Android work profile, clones or drops a tampered banking app into it, and uses Accessibility overlays and other controls to steal credentials and perform fraudulent transactions; the chain is confirmed in Indonesia with observed compromises and estimated losses, while samples targeting many other countries were found.