GoKawiilGoldFactory's Gigabud Trojan Exploits Android Work Profiles in Indonesia Bank Fraud
Group-IB researchers found that the Chinese-speaking threat group GoldFactory has been abusing Google's Work Profile feature to clone victims' banking apps into isolated, hidden environments where fraud-detection tools can't reach. The campaign, powered by the Gigabud Android Trojan and a cloning tool called Vwork, compromised roughly 1,469 devices and 1,281 logins in Indonesia between February and July, causing nearly $1 million in losses.
GoKawiil's interpretation of the reporting above, not reported fact.
By hijacking a legitimate enterprise feature meant to separate work and personal apps, attackers can sidestep the security checks banks rely on to spot fraud, making detection far harder. Gigabud has already spread across Southeast Asia, South Asia, the Middle East, Africa and Latin America, so this evasion technique could quickly become a template for banking fraud campaigns worldwide.
- GoldFactory used Android's Work Profile feature to clone banking apps into isolated spaces invisible to fraud detection.
- The Gigabud Trojan, active since 2022, gives attackers live remote control of infected phones via fake government and airline apps.
- Indonesia lost nearly $1 million across 1,469 compromised devices in just five months, signaling a scalable global threat.
Yubico YubiKey 5 NFC Security Key — When Android banking Trojans like Gigabud can hijack apps and intercept codes on the phone itself, a hardware key keeps the login secret off the device entirely. The YubiKey 5 NFC taps against a phone or plugs into USB-A to confirm sign-ins for accounts that support FIDO2/U2F, so a cloned app can't just replay your credentials.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com — Alexander Culafi, 2026-09-11
Published there as: “Indonesia Hit by Android Banking App-Cloning Campaign”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.