MalwareUsed by 1 actor

Gigabud

Gigabud is an Android banking remote-access trojan active since 2022 and associated with the Chinese-speaking financially motivated GoldFactory cybercrime group. It is distributed through fraudulent Android applications impersonating government agencies, tax services, airlines, financial institutions, and loan services. Victims are typically directed to sideload these applications through phishing sites, messaging platforms, SMS, and social-media lures.

After installation, Gigabud requests Accessibility access, overlay privileges, screen-recording capability, and exemption from battery optimization. These permissions enable operators to remotely interact with the device, enumerate installed applications, record the screen, display counterfeit banking-login prompts, capture banking credentials and device unlock codes, send SMS messages, alter clipboard data, and automate banking activity. Some versions include Accessibility-based keylogging functionality focused on banking credentials and can obscure fraudulent activity by displaying a black screen.

Recent Gigabud operations deploy Vwork, a weaponized modification of the Android work-profile utility Shelter. Vwork can create an isolated Android Work Profile and clone or install a targeted banking application within it under Gigabud operator control. This profile separation can weaken fraud and malware-detection controls that do not correlate activity between personal and work profiles, allowing fraudulent banking sessions to appear detached from malware present in the primary profile. Confirmed activity has affected Indonesian users, while compatible samples have targeted victims across Southeast Asia, South Asia, the Middle East, Africa, and Latin America. Gigabud also includes the related Gigabud.Loan variant, a fraudulent loan application designed to harvest victims’ personal and financial information rather than provide full remote-access functionality.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

GoldFactory

“The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it.”

via the hacker newsthehackernews.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence6

“Victims are lured into sideloading a fake airline, tax, or government app through phishing sites, messages, or social media.”

Execution

1 technique

T1204.002Malicious FileEvidence3

“Victims are lured into sideloading a fake airline, tax, or government app.”

Persistence

1 technique

T1546.008Accessibility FeaturesEvidence1

On first launch, it asks for Accessibility access... Giving it Accessibility access is the point where the operator gains real control of the device.

Privilege Escalation

1 technique

T1546.008Accessibility FeaturesEvidence1

On first launch, it asks for Accessibility access... Giving it Accessibility access is the point where the operator gains real control of the device.

Stealth

2 techniques

T1036MasqueradingEvidence4

[Gigabud] reaches phones as a fake app posing as a national airline, a tax office, or a government portal.

T1564Hide ArtifactsEvidence6

“Vwork ... hides its launcher icon” and the operator can conduct transactions “with the option to hide activity behind a black screen.”

Credential Access

2 techniques

T1056Input CaptureEvidence2

“A fake login screen appears on top of it and captures whatever is typed. A separate, invisible overlay also captures the phone’s lock screen code.”

T1056.003Web Portal CaptureEvidence1

“Fake banking-login overlays steal both banking credentials and the device’s PIN.”

Discovery

1 technique

T1518Software DiscoveryEvidence3

“The sideloaded app checks which other apps are installed and tells the operator which relevant banking targets are present.”

Collection

3 techniques

T1005Data from Local SystemEvidence1

“Gigabud includes commands to ... upload the clone list.”

T1056Input CaptureEvidence2

“A fake login screen appears on top of it and captures whatever is typed. A separate, invisible overlay also captures the phone’s lock screen code.”

T1056.003Web Portal CaptureEvidence1

“Fake banking-login overlays steal both banking credentials and the device’s PIN.”

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence3

The trojan includes commands to provision the profile, clone a target app, and report back what was copied, while requiring a token from an external authorization server before cloning begins.

T1219Remote Access ToolsEvidence4

“Vwork modifies those functions so that Gigabud can control them remotely” and “The operator can then remotely carry out transactions from the newly created profile.”

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

“Gigabud sends a full list of every app installed on the phone back to the operator”; “Gigabud implements logic to obtain that token from an exfiltration server.”

Other

1 technique

T1562Impair DefensesEvidence1

“A cloned environment is used to evade fraud protection controls”; “fraudsters can effectively break the link between the malware detection signal and the fraudulent transaction.”

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

9 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app23 days ago

ACTIVITY FEED

Recent activity

16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

16 SOURCESView more in app

cysecurity newsNews

Sep 11, 2026

Gigabud Android Trojan Uses App Cloning to Evade Fraud Detection - CySecurity News - Latest Information Security and Hacking Incidents

Android banking trojan used for mobile-banking fraud. It leverages Android Work Profile isolation to clone a target banking app, separating the cloned app and subsequent payment activity from the victim's personal profile and undermining fraud correlation. It can provision the profile, clone target apps, report cloned-app information, and requires an external authorization-server token before cloning.

malware newsNews

Sep 11, 2026

Android malware creates a hidden copy of your banking app - Malware News - Malware Analysis, News and Indicators

Android banking trojan that lures victims into sideloading fake apps, abuses Accessibility and overlay permissions to steal banking credentials and device PINs, and installs Vwork to create a work profile containing a cloned banking app. Operators can remotely conduct and conceal fraudulent transactions from the isolated profile.

malwarebytes labsNews

Sep 11, 2026

Android malware creates a hidden copy of your banking app | Malwarebytes

Android banking trojan that is delivered through sideloaded fake airline, tax, or government applications. It abuses Accessibility, overlay, and battery-optimization-exemption permissions to support remote device interaction, banking-login overlays, theft of banking credentials and device PINs, and identification of installed banking applications. It uses Vwork to create a work profile and clone a targeted banking app, allowing operators to conduct fraudulent transactions from a profile separate from malware activity in the personal profile.

gurucul threat researchNews

Sep 10, 2026

Vwork: Weaponized Open-source Software as an Addon for Gigabud | Community Portal | Gurucul

Android banking trojan deployed with the Vwork app-cloning add-on. The combination hides the trojan through an isolated Android Work Profile while enabling remote control of compromised devices.

+12 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Gigabud