Loading story…
A GoldFactory-linked Android banking-fraud operation is using the Gigabud remote-access trojan and Vwork, a modified version of the open-source Shelter app cloner, to duplicate banking apps inside concealed Android work profiles. The isolated profile makes fraudulent banking sessions appear clean by separating them from malware indicators and risk signals associated with a victim’s personal profile, helping attackers bypass bank fraud detection, take over accounts, and initiate unauthorized transfers.
Victims are lured through phishing sites, messaging apps, and social-media posts to sideload fake airline, tax, government, or banking applications. Gigabud abuses Accessibility, overlay, and battery-optimization-exemption permissions for remote control, credential theft, installed-app discovery, banking overlays, and lock-screen code capture. Group-IB identified compatible activity in multiple countries; in Indonesia, it recorded 1,469 compromised devices, 1,281 potentially compromised logins, and an estimated $960,939 in losses between February and July 2026.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Between February and July 2026, Group-IB observed approximately 1,469 compromised devices and 1,281 potentially compromised logins in Indonesia, with estimated losses of about $960,939.
The Gigabud Android remote-access banking trojan has been active since 2022.
The reporting identified Vwork package ID net.yy.vwork and published SHA-256 hashes for Gigabud, Vwork, and modified banking-application samples associated with the campaign.
Group-IB linked Gigabud activity using Vwork, a modified Shelter application cloner, to GoldFactory. The operation uses concealed Android work profiles to host cloned or tampered banking apps and separate fraudulent sessions from malware risk signals in the personal profile.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
9 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourcemalware.news
Open sourcemalwarebytes.com
Open sourcecommunity.gurucul.com
Open sourcethehackernews.com
Open sourceinfosecurity-magazine.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcegroup-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Group-IB detailed the **Gigabud** Android malware family, linking a previously undocumented remote access trojan, **Gigabud.RAT**, with a fake loan application, **Gigabud.Loan**, after a Thailand-based financial organization reported a sample targeting its customers. Investigators said both variants share architecture and the same signing certificate, and were distributed through phishing websites and direct messaging campaigns in Thailand, Indonesia, Vietnam, the Philippines, and Peru, often masquerading as government agencies, banks, or lenders to persuade victims to install malicious APKs. The **Gigabud.RAT** variant abuses Android screen recording and accessibility services to take remote control of devices, steal credentials, bypass authentication, manipulate clipboard contents, and potentially automate payments; newer samples also added a module designed to steal passwords from banking apps. **Gigabud.Loan** posed as low-interest lending apps and harvested extensive personal and financial data from applicants. Group-IB said it identified more than **400** Gigabud.RAT samples and over **20** Gigabud.Loan samples between 2022 and 2023, indicating sustained operations and expansion across multiple countries.
Aug 14, 2026
Zimperium zLabs identified four Android malware families—**RecruitRat, SaferRat, Astrinox, and Massiv**—in active campaigns targeting users of more than **800 banking, cryptocurrency, and social media apps**. The malware is being spread through phishing sites, smishing messages, fake job application and streaming lures, counterfeit app-store pages, and bogus updates that trick victims into installing malicious APKs. Researchers said the campaigns rely heavily on overlay attacks, with fake login screens placed over legitimate apps to steal credentials; **RecruitRat** alone reportedly includes more than **700** fraudulent login pages. Once installed, the trojans abuse Android features including **Accessibility Services**, the **Session Installation API**, **MediaProjection**, overlays, and **WebView** to gain persistence, intercept SMS and one-time passwords, log keystrokes, enumerate apps, steal contacts, freeze screens, stream displays, and remotely control infected devices. The malware also uses anti-analysis techniques such as APK tampering, encrypted strings, reflection, dynamic DEX loading, and environment-aware execution, while command-and-control traffic is sent over HTTPS or WebSockets, with RecruitRat additionally using **RC4** encryption. Researchers warned the activity creates enterprise risk because infected employee devices can enable account takeover, bypass MFA, and expose corporate resources.
Jun 29, 2026
Researchers reported that the **Gustuff** Android banking trojan evolved from an earlier malware family into a more capable fraud platform that spreads mainly through SMS links to malicious APKs and social-media-themed lures. Initially marketed on Russian-speaking criminal forums as an updated version of AndyBot, Gustuff was offered for lease and aimed largely at victims outside Russia. The malware was observed targeting users in Australia and other countries including the United States, Poland, Germany, and India, with victim lists spanning more than 100 banking apps, dozens of cryptocurrency services, fintech platforms, marketplaces, payment systems, messengers, hiring apps, and the Australian Government Portal. The updated malware relies heavily on Android **Accessibility Service** to automate on-device fraud, including interacting with legitimate apps, displaying fake push notifications and overlays, and using an Automatic Transfer System to fill transaction fields. Researchers said newer versions reduced static indicators by loading target app lists dynamically from command-and-control servers and added JavaScript-based scripting, asynchronous task handling, improved command tracking, and an interactive mode for automated actions on infected devices. Gustuff also retained broad device-control features, including reading and sending SMS messages, issuing USSD requests, exfiltrating files and device data, launching a SOCKS5 proxy, disabling Google Protect in many cases, resetting devices, and maintaining resilience through an SMS-based secondary administrative channel when primary C2 infrastructure was disrupted.
Aug 15, 2026