Loading story…
Group-IB detailed the Gigabud Android malware family, linking a previously undocumented remote access trojan, Gigabud.RAT, with a fake loan application, Gigabud.Loan, after a Thailand-based financial organization reported a sample targeting its customers. Investigators said both variants share architecture and the same signing certificate, and were distributed through phishing websites and direct messaging campaigns in Thailand, Indonesia, Vietnam, the Philippines, and Peru, often masquerading as government agencies, banks, or lenders to persuade victims to install malicious APKs.
The Gigabud.RAT variant abuses Android screen recording and accessibility services to take remote control of devices, steal credentials, bypass authentication, manipulate clipboard contents, and potentially automate payments; newer samples also added a module designed to steal passwords from banking apps. Gigabud.Loan posed as low-interest lending apps and harvested extensive personal and financial data from applicants. Group-IB said it identified more than 400 Gigabud.RAT samples and over 20 Gigabud.Loan samples between 2022 and 2023, indicating sustained operations and expansion across multiple countries.
See the actors and campaigns active against you right now.
6 events from the most recent confirmed update back to the earliest known activity.
In January 2023, cybersecurity researchers named the trojan Gigabud based on the malicious application's certificate issuer name. Group-IB later used the name for the broader malware family that includes multiple variants.
In September 2022, a Thailand-based financial organization asked Group-IB to investigate an Android malware sample targeting its clients and other customers in the Asia-Pacific region. This investigation led researchers to identify the sample as a previously undocumented Android remote access trojan.
Group-IB reported that the Gigabud.Loan variant had been active since at least July 2022. The fake loan app impersonated fictional financial institutions and stole user-submitted personal and financial data.
In July 2022, Thailand's Department of Special Investigation warned about a phishing site impersonating the agency's website that was distributing the same Android RAT later identified as Gigabud. This is an early official warning tied to the campaign's activity in Thailand.
From 2022 to 2023, Group-IB detected more than 400 Gigabud.RAT samples and more than 20 Gigabud.Loan samples using VirusTotal hunting rules. The findings indicated sustained activity and expansion across multiple countries.
During its analysis, Group-IB identified a second variant called Gigabud.Loan and concluded it shared architecture and the same certificate with Gigabud.RAT. The company attributed both variants to the same Gigabud malware family.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Gustuff** Android banking trojan evolved from an earlier malware family into a more capable fraud platform that spreads mainly through SMS links to malicious APKs and social-media-themed lures. Initially marketed on Russian-speaking criminal forums as an updated version of AndyBot, Gustuff was offered for lease and aimed largely at victims outside Russia. The malware was observed targeting users in Australia and other countries including the United States, Poland, Germany, and India, with victim lists spanning more than 100 banking apps, dozens of cryptocurrency services, fintech platforms, marketplaces, payment systems, messengers, hiring apps, and the Australian Government Portal. The updated malware relies heavily on Android **Accessibility Service** to automate on-device fraud, including interacting with legitimate apps, displaying fake push notifications and overlays, and using an Automatic Transfer System to fill transaction fields. Researchers said newer versions reduced static indicators by loading target app lists dynamically from command-and-control servers and added JavaScript-based scripting, asynchronous task handling, improved command tracking, and an interactive mode for automated actions on infected devices. Gustuff also retained broad device-control features, including reading and sending SMS messages, issuing USSD requests, exfiltrating files and device data, launching a SOCKS5 proxy, disabling Google Protect in many cases, resetting devices, and maintaining resilience through an SMS-based secondary administrative channel when primary C2 infrastructure was disrupted.
Aug 15, 2026
A GoldFactory-linked Android banking-fraud operation is using the Gigabud remote-access trojan and **Vwork**, a modified version of the open-source Shelter app cloner, to duplicate banking apps inside concealed Android work profiles. The isolated profile makes fraudulent banking sessions appear clean by separating them from malware indicators and risk signals associated with a victim’s personal profile, helping attackers bypass bank fraud detection, take over accounts, and initiate unauthorized transfers. Victims are lured through phishing sites, messaging apps, and social-media posts to sideload fake airline, tax, government, or banking applications. Gigabud abuses Accessibility, overlay, and battery-optimization-exemption permissions for remote control, credential theft, installed-app discovery, banking overlays, and lock-screen code capture. Group-IB identified compatible activity in multiple countries; in Indonesia, it recorded 1,469 compromised devices, 1,281 potentially compromised logins, and an estimated $960,939 in losses between February and July 2026.
Sep 11, 2026
Researchers reported that **Ghimob**, an Android banking trojan linked to Brazil’s Guildma operation and the broader **Tétrade** malware family, was built to steal from users of financial and cryptocurrency apps by letting operators control transactions directly on infected phones. The malware is delivered through malicious links that serve either Windows ZIP archives or Android APKs based on the visitor’s user agent, tying the mobile activity to infrastructure also used in Guildma’s Windows campaigns. Although early observed victims were in Brazil, the malware was configured to target institutions in multiple countries, including Paraguay, Peru, Portugal, Germany, Angola, and Mozambique. Ghimob abuses Android **Accessibility** services to gain persistence and remote-control capabilities, then hides its icon and interferes with uninstallation and shutdown attempts to stay on the device. Its command-and-control design also reflects the **fallback channel** pattern tracked as MITRE ATT&CK `T1008`, using redundant methods to recover real C2 servers through Cloudflare-protected infrastructure and DGA-like techniques when primary paths are unavailable. The combination of anti-analysis checks, resilient C2, and on-device fraud execution makes Ghimob a capable mobile banking threat with clear potential for international expansion.
Aug 15, 2026