- The Mess: GoldFactory has weaponized Android Work Profiles with Vwork, a modified clone of the open-source Shelter app, to hide tampered banking apps from security checks.
- The Damage: Gigabud can move the banking target into a separate Android profile where the original banking app may no longer see the malware sitting outside its sandbox.
- The Fix: Treat unexpected Work Profiles as an incident, remove untrusted profile-management apps, and investigate the device before trusting banking sessions again.
Android Work Profiles were built to separate things.
GoldFactory decided to use that separation against the security controls protecting banking applications.
Group-IB has documented a new Gigabud attack chain involving Vwork, a weaponized version of the open-source Shelter application. Vwork abuses Android’s managed-profile functionality to create a second environment on the victim’s phone and clone selected applications into it.
The technique was confirmed on infected devices in Indonesia.
The Malware Moves the Banking App
The interesting component is not Gigabud alone.
It is the combination of Gigabud and Vwork.
Vwork uses Android’s legitimate Work Profile mechanism. Normally, that profile exists to separate corporate applications and data from a user’s personal environment. Android implements the separation through its multi-user architecture, application permissions and SELinux controls.
GoldFactory turns that legitimate isolation into an evasion layer.
The attacker can create a managed profile and place a modified banking application inside it. The banking malware detection code running in the normal profile may not have visibility into applications living in the separate profile.
The security boundary becomes the hiding place.
Shelter Became the Weapon
Shelter itself is not the malware.
It is an open-source Android application designed to use Work Profile functionality for application isolation and cloning.
GoldFactory took that concept and produced Vwork, a modified version adapted for its Gigabud operation. Group-IB describes Vwork as a weaponized copy of Shelter that has been incorporated directly into the attack chain.
That distinction matters because defenders cannot simply blacklist “Gigabud.”
They need to recognize suspicious use of legitimate Android management functionality.
This is classic abuse of trusted infrastructure: nothing about a Work Profile is inherently malicious.
The attacker just found a useful place to put the malicious copy.
Why Banking Defenses Can Miss It
Many banking applications perform local security checks.
They look for known malware, dangerous applications, debugging environments and other indicators that the device has been compromised.
But Android profiles are intentionally isolated.
Google’s Android security documentation describes Work Profiles as separate environments with their own application and data boundaries. Cross-profile access is controlled through Android’s policy mechanisms rather than being universally available to applications.
That creates a nasty detection problem.
A banking application in one profile can be checking the phone while the attacker’s modified copy sits somewhere else.
The victim sees a familiar banking interface.
The security logic sees a much cleaner environment.
The Attack Is Bigger Than One App
Once a cloned banking application is operating inside the managed profile, GoldFactory can combine the setup with the capabilities already associated with Gigabud.
The result is not simply a hidden APK.
It is an attack architecture where profile isolation becomes part of the fraud infrastructure.
That makes traditional mobile security assumptions less reliable.
“Is the malicious app installed?”
is no longer enough.
The better question becomes:
Which Android profiles exist, who created them, and what applications are running inside them?
What Defenders Should Look For
Mobile security teams should watch for unexpected creation of managed profiles, especially on devices that are not enrolled in legitimate enterprise management.
Investigate suspicious profile-owner applications and newly installed applications associated with Work Profile provisioning.
Users should also pay attention to unexpected work badges, new profile-management prompts or banking applications appearing in a separate workspace without a legitimate reason.
Do not install APKs from unofficial sources simply because the application appears to provide useful cloning, privacy or productivity functionality.
And if a banking device suddenly develops an unexplained Work Profile, assume something is wrong until proven otherwise.
Bugstoday Opinion
GoldFactory did not need to break Android’s sandbox.
It found a legitimate sandbox and put the attack inside it.
That is the part mobile defenders should remember. Security boundaries are useful only when the software on both sides understands what the other side can and cannot see.
Vwork turns Android’s clean separation model into a hiding mechanism for a banking trojan.
The feature works exactly as designed.
The attacker simply designed around it.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Group-IB — Vwork: Weaponized Open-source Software as an Addon for Gigabud
Android Open Source Project — Android Enterprise Security Paper
Android Open Source Project — Android Compatibility Definition
