Loading threat actor…
GoldFactory is a financially motivated, Chinese-speaking cybercrime group active primarily in the Asia-Pacific region and focused on mobile banking fraud. The group is associated with an interconnected Android malware ecosystem that includes GoldPickaxe, GoldDigger, GoldDiggerPlus, Gigabud, MMRat, Remo, and Gigaflower. Its operations have heavily targeted Southeast Asian users, especially in Indonesia, Thailand, and Vietnam, with campaigns aimed at customers of mobile banking, e-wallet, and other financial applications. GoldFactory is known for social-engineering-driven initial access, including phishing sites, fake application storefronts, impersonation of government or public-service entities, phone calls, and messaging-based lures. The group has distributed trojanized or modified banking applications and has also used droppers that install second-stage Android payloads through legitimate platform APIs. Its malware commonly employs encrypted payloads, dynamic code loading, hidden launcher activity, anti-analysis tampering, and encrypted command-and-control communications to evade detection and hinder reverse engineering. Post-compromise, GoldFactory malware supports extensive device takeover and fraud-enablement functions. Observed capabilities include credential theft, theft of lock-screen secrets, SMS and contact exfiltration, call-log and device-data collection, keylogging, screen capture and screen sharing, overlay-based theft, text injection, gesture simulation, and remote downloading or installation of additional applications. Some GoldFactory tooling also abuses Android accessibility features for on-screen content capture and remote interaction. The group has additionally collected identity documents and facial biometric recordings, indicating a focus on defeating banking verification and e-KYC workflows. GoldFactory has also used runtime hooking frameworks and injected malicious code into legitimate banking apps while preserving normal app functionality, enabling stealthier fraud operations and bypass of security controls. Reported tooling families such as FriHook, SkyHook, and PineHook illustrate the group’s use of mobile instrumentation and hooking techniques to conceal activity, manipulate app behavior, and scale campaigns. Recent reporting indicates the group shifted away from iOS-focused activity and concentrated on Android operations, likely reflecting the greater operational flexibility of the Android ecosystem for large-scale banking fraud.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
6 malware families attributed to this actor across reporting.
1 additional family tracked in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Chinese-speaking cybercrime group attributed with operating the GoldPickaxe Android banking trojan campaign targeting mobile banking, e-wallet, and finance app users, primarily in Southeast Asia, using phishing sites spoofing the KuaiBo app and dropper APKs to steal biometric data, banking credentials, SMS, contacts, and enable remote control.
Cybercrime group behind the GoldPickaxe mobile banking trojan campaign, targeting mobile banking, e-wallet, and financial application users in Southeast Asia/APAC via phishing websites and malicious Android apps.
Financially motivated mobile-focused cybercrime group distributing modified banking apps and custom Android/iOS malware families to compromise victims, particularly in Southeast Asia, via impersonation of government services.
Financially motivated phishing campaigns impersonating Indonesia’s tax platform to steal money from Android users (notably during tax season).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.