Introduction
During the “Hook for Gold” research, Group-IB discovered an application called Vwork that was installed within minutes after initial Gigabud infection along with tampered banking applications. Trials to find a sample of Vwork lead to Gigabud samples that are intentionally built to interact with Vwork. The significance of this finding meant that Vwork on infected devices cannot be considered a coincidence anymore. This article reveals what Vwork is, and how it is related to Gigabud.
What is Gigabud? Gigabud is an Android remote access banking trojan active since 2022. Currently it is detected in attacks across Southeast Asia, South Asia, Middle East, Africa and Latin America. Group-IB attributes Gigabud development to the GoldFactory group. The lure varies by region, impersonating national airlines, tax authorities, or government portals. Once installed and granted permissions, it gives its operator live remote control of the victim’s phone.
What is Vwork? Vwork is a fork of the open-source Android cloning application Shelter. Both Vwork and Shelter utilize the Android Work Profile feature to create isolated application space. While Shelter is implied to be operated manually by the device owner, Vwork exposes controls as an API allowing third-party applications perform cloning and related application management. Details on differences between Shelter and Vwork are in the Technical Analysis section.
How do they relate? Vwork doesn’t have its own C2 communications function, so it requires an external application installed on the same device. According to Group-IB Fraud Protection telemetry, Vwork is installed on victim devices after Gigabud to clone banking applications into the work profile. Gigabud sample analysis revealed new C2 commands specifically to operate with Vwork. Running the application inside the work profile hides Gigabud in the personal profile from signature detection in the application security SDK.
Key discoveries
- A new defense evasion technique in Android banking malware: cloning target applications into a managed profile with help of Vwork.
- Vwork is a weaponised copy of an open-source app Shelter, a cloning app that utilises Android Work Profile feature.
- GoldFactory group has incorporated Vwork into their arsenal and using it with Gigabud.
- Gigabud and Vwork infection chain confirmed on devices in Indonesia.
- Gigabud samples with Vwork capabilities found targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, Philippines, Thailand, Türkiye, and a GCC member state.
Who may find this blog interesting:
- Cybersecurity analysts and corporate security teams
- Malware analysts
- Threat intelligence specialists
- Cyber investigators
- Fraud Analysts
- Law enforcement investigators
- Cyber police forces
Group-IB Threat Intelligence and Fraud Protection Portals:
Group-IB customers can access our Threat Intelligence and Fraud Protection portals for more information about the GoldFactory threat actor, Gigabud and Vwork malware described in this blog:
- GoldFactory Fraud Intelligence
- GoldFactory Threat Intelligence
- Vwork Fraud Intelligence
- Vwork Threat Intelligence
- Gigabud Fraud Intelligence
- Gigabud Threat Intelligence
Victimology And Impact
Since Vwork is not observed to be a standalone application but a companion for Gigabud, and Gigabud is the Android malware targeting mainly financial services such as banking and crypto, it suggests that the target industries are the same though only banking is confirmed within Group-IB data presented in this report.
Gigabud samples compatible with Vwork have been identified targeting the following countries: Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, Philippines, Thailand, Türkiye, and a GCC member state.
In Indonesia alone, from Feb – Jul 2026, about 1,469 compromised devices and 1,281 potentially compromised logins have been observed by Group-IB researchers, with an estimated loss of roughly USD $960,939. These figures reflect observed activity and should be considered indicative rather than representative of the full impact in the region.
- Delivery – Employing social engineering through phishing sites, direct messenger apps, or social media, victims are let to install fake apps–disguised as legitimate airline, tax authority, or government services–containing the Gigabud malware outside of official app stores.
- Permission request – On first launch, Gigabud asks for Accessibility access, permission to draw over other apps, and an exemption from battery saving. Granting Accessibility is the moment the operator gains real control of the device.
- Check-in – Gigabud sends a full list of every app installed on the phone back to the operator to identify specific banking targets, allowing more focused attacks instead of targeting every bank, then opens a live connection to the operator’s server and waits for instructions.
- Credential theft – When the victim opens their real banking app, a fake login screen appears on top of it and captures whatever is typed. A separate, invisible overlay also captures the phone’s lock screen code.
- App cloning – The operator tells Gigabud to install Vwork. Gigabud sent a command to Vwork to clone a specific app into its hidden work area. In one of the confirmed cases observed through this research, the copy was a fake version of a real Indonesian bank’s app.
- Fraud and cash out – With full remote control, and where relevant a cloned banking app in place, the operator carries out transactions directly on the victim’s phone while a black screen hides what is happening. A cloned environment is used to evade fraud protection controls. If this environment is installed and not detected, fraud transactions may bypass monitoring and result in unauthorized cash-out.
Why Vwork
Applications installed in one Android profile are generally isolated from those in another profile, especially for signature-based malware detection. As a result, malware detected in a personal profile does not necessarily trigger an alert for the same malware activity in a separate work profile, let alone if that work profile is created after the initial malware installation.
Fraudsters exploit this isolation to evade detection. They first install the malware in the victim’s personal profile but do not immediately perform unauthorized transactions there. Although the bank may detect suspicious activity, the absence of an associated financial loss may prevent further action.
The fraudster then uses Vwork to create a separate work profile and clones the targeted banking application into it. Transactions are subsequently conducted from the newly created work profile.
From the bank’s perspective, the transaction originates from a new device and may appear unrelated to the previously detected malware activity. Meanwhile, the malware detection alert has already been triggered in the victim’s personal profile but will not fire in the newly created work profile due to a lack of infection signals.
By exploiting this separation between profiles, fraudsters can effectively break the link between the malware detection signal and the fraudulent transaction, allowing them to evade existing security controls and successfully cash out.
Infection Chain Captured by Group-IB Fraud Protection:
Technical Analysis
The matching architecture and class names provide strong evidence that Vwork is a fork of the open-source Android application Shelter, with additional modifications and interfaces introduced to support malicious capabilities.
The analyzed Vwork sample appears to be from an active development stage. Some of the newly introduced capabilities remain unstable and do not behave as intended on AOSP-like Android builds. At the same time, several OEM-specific code branches appear to be bug fixes for the upstream Shelter codebase.
The key differences between Vwork and Shelter are outlined below:
- Shelter’s cross-profiles intent signatures are removed allowing any application to interact with Vwork.
- Shelter’s cross-profile file exchange is changed in a way so that Vwork serves read/write files capability for any application within the same profile.
- Vwork ensures sideloading is allowed and Accessibility service is restricted in the provisioned profile.
- Two new exported components exposing four primary actions: start work profile provisioning, clone applications, list cloned applications and open arbitrary application.
- Vwork cloning capability requires authorization with an external server. Vwork performs authorization flow using server address and token provided from a third-party application (Gigabud) along with target package name.
Compared to Shelter, the multi-step user awareness activities are flattened to a single screen prompt during Vwork’s work profile setup (as shown in Figure 6 below). The Chinese-language text translates to “Welcome to Vwork. Tap ‘Activate now’ and it will guide you through setting up the work profile.” After installation, the Vwork icon is also not shown in the launcher. Despite this, victims can still spot the application in the file manager (also Figure 6) due to the fact that Vwork still acts as a document provider.
While the core architecture of the UI remains unchanged from Shelter, Vwork’s UI is trimmed and translated to Chinese. UI text is rebranded from work profile language to virtual space. Internal settings control is also fully delegated to external applications and is not available in the UI anymore.
In summary, these changes make Vwork’s presence less visible to device owners and expose its cloning functions as an API to external apps. Shelter is primarily operated through a UI, and we can conclude that its repackaging to Vwork is a deliberate attempt to weaponise device owner-controlled cloning to third party application-operated cloning in order to facilitate malicious activity.
Connection with Gigabud
Some Gigabud samples discovered during “Hook for Gold” research were observed to declare the Vwork package name, net.yy.vwork
, in the queries element
of the Android Manifest along with old QUERY_ALL_PACKAGES
permission.
These Gigabud samples have explicit interaction with Vwork. Old core logic C2 command openAPPList
and app inventory mechanism now have dedicated code branches to interact with Vwork. Package names in such cases are prefixed with vwa
– in C2 messages, i.e. vwa-com.example.application
. Additionally there are three new C2 commands that primarily interact with Vwork: initVwa
, cloneApp
, uploadCloneApps
.
As per above, cloneApp
operation relies on an external authorization server. Gigabud implements logic to obtain that token from an exfiltration server suggesting this server is able to carry out Vwork authorization.
Threat Actor Attribution
Vwork was detected in the wild only in the “Hook for Gold” campaign which Group-IB has attributed to GoldFactory.
Technical analysis of the Vwork sample reveals a dedicated code branch references to Gigabud package names while showing overlapping network indicators and developer logs in Chinese.
This data is sensitive and cannot be published publicly, but Group-IB customers can view these indicators on our Threat Intelligence portal.
From these facts, we can conclude that Gigabud is not just built to interact with Vwork, but both of them are developed or customized by the GoldFactory group.
Detection and Prevention
The earliest reliable warning in this chain arrives well before any credential theft: an ordinary consumer phone, one that was never set up by an employer’s IT department or by the user themselves, suddenly creating an isolated work profile is already unusual on its own. Behavioral breakdowns include:
- An isolated environment / work profile appearing on a phone that was not intended by the user.
- Identical banking application installation markers across profiles.
- An isolated, clean environment with no common legitimate user apps (e.g., banking, messaging, or social media), designed to conceal malicious activity.
- Accessibility access enabled for an app that should not require them.
- A device management feature being used to grant an app control over every other installed app, with no approval screen shown, something no legitimate consumer tool has a reason to do.
- An unexpected app installation from a non-legitimate source landing on the phone within a short period from a previous app install.
Group-IB Fraud Protection correlates these signals together and treats two or more appearing in the sessions as high risk, sufficient to block a transaction directly. Device binding and key signing controls separately stop stolen logins from being used to authorize transactions on an attacker controlled device, regardless of whether an earlier stage was caught.
Conclusion
Gigabud and Vwork show a deliberate choice by one operator to split a single scheme into two separate tools, one to take over the phone and one to manage work profile. Splitting the work this way allows the malicious application to stay in an isolated profile hidden from signature-based malware detection engines. It also shows how easily legitimate software can be abused. The early warning for defenders are the unusual use device profile, combined with suspicious app-cloning behavior, either a banking app impersonation, or a genuine but outdated app sideloaded outside the official app store.
Recommendations
For end users:
- Install apps only from official stores, refuse Accessibility access for any app that is not an accessibility tool, and use a second factor that does not rely on SMS for banking and crypto apps.
For banks and wallet providers:
- Tie logins to a specific trusted device, watch for unusual timing and ordering of actions within a session, and block transactions from any device showing active Accessibility access on an unrecognised app.
For security vendors:
- Implement both signature-based and behavioral detections such as Group-IB Fraud Protection platform. Fraudsters are evolving and sticking to only one method is insufficient to detect malicious activity in time.
For regulators and government:
- Require official apps to be distributed only through verified stores, and remind users publicly that a legitimate app is never shared as a raw file inside a chat app.
Acknowledgement of Research Support
- Yuan Huang, Global Fraud Intelligence Lead
- Andrey Polovinkin, Team Lead Reverse Research
Group-IB Fraud Matrix
| T2031.001 | Develop Malware. Gigabud capabilities extended to interact with Vwork |
| T2165 | Phishing Resource. Gigabud samples compatible to Vwork are distributed with phishing pages. |
| T2015.001 | Fake Mobile Application. Gigabud is disguised as a national airline, tax authority, or government portal app. |
| T2093 | Enabling Accessibility Service for Malware. Gigabud prompts victims to enable Accessibility access during its first launch. Vwork ensures Accessibility Services restricted in work profile. |
| T2106 | Pushing to Visit Phishing Resource. The victim is persuaded or pressured to take actions that enable the fraud: clicking links, installing APK, opening bank apps, or following the fraudster’s instructions. |
| T2090 | Phishing. The phishing page is one of the confirmed delivery vectors. |
| T2158 | Scam Message in Social Network/Instant Messenger. Delivery occurs via messenger app and social media posts. |
| T2177 | Pushing to Install Malware. The victim is directed to install the disguised Gigabud outside the official store. |
| T2137 | App Overlay. Gigabud’s fake login screen appears over the real banking app the moment it opens. |
| T2180 | Credentials Capture. Gigabud captures credentials via fake overlays (exfiltrated) and screen sharing, primarily to obtain victims’ banking credentials and enable account takeover, and ultimately cash out funds. |
| T2151 | Keylogger. Separate accessibility-based text-input monitoring captures keystrokes. |
| T2148 | Device Remote Access. Accessibility grant hands the operator live read/tap/type control of the screen. |
| T2080 | Account Access on Victim Device. Transactions run inside the real (or cloned) banking app, on the victim’s own device. |
| T2188.002 | Automation via Mobile App. Accessibility-driven automated transaction execution (ATS) which utilizes operator-scripted taps/text injection, not manual remote-control-only. |
| T2192 | Code Obfuscation. Both Vwork and related Gigabud samples are packed with dpt-shell. |
| T2097.001 | Mobile Application Cloning. Work Profile used as an isolated environment to run a cloned banking app invisibly. |
| T2191 | Background Task Persistence. Multiple independent mechanisms keep the app running after reboot. |
| T2114 | Issuing Transfer on Demand. The operator initiates transfers directly from the victim’s account via automated on-screen control. |
MITRE ATT&CK
| T1660 | Phishing. Fraudsters use phishing including smishing and vishing to deliver Gigabud. |
| T1575 | Native API. Gigabud uses native API to implement RTMP-streaming, persistence and lock screen pattern collection. Both Vwork and Gigabud are packed with dpt-shell that uses native API. |
| T1603 | Scheduled Task / Job. Multiple persistence mechanisms implemented in Gigabud including WorkManager API. |
| T1577 | Compromise Application
Executable. Modified banking app is delivered as the clone payload |
| T1624 | Event Triggered Execution. Interaction between Vwork and Gigabud is based on intents. |
| T1626.001 | Abuse Elevation Control:
Device Administrator. Both Vwork and Gigabud requests device admin permissions. |
| T1407 | Download New Code at Runtime. Gigabud is used as a loader for Vwork and modified banking applications. |
| T1541 | Foreground Persistence. Gigabud runs screenrecording and camerastreaming as foreground services. |
| T1628.001 | Hide Artifacts: Suppress Application Icon. Vwork application icon is hidden from the launcher. |
| T1628.002 | Hide Artifacts: User Evasion. Black screen overlay and audio mute during automated fraud |
| T1629 | Impair Defenses. Vwork creates the work profile to hide installed malware. |
| T1630 | Indicator Removal on Host. Vwork creates the work profile to hide installed malware. |
| T1516 | Input Injection. Accessibility service abused to execute transactions inside banking apps |
| T1655.001 | Masquerading: Match Legitimate Name or Location. Gigabud uses airlines, government and social services lures. |
| T1406.002 | Obfuscated Files or Information: Software Packing. Both Vwork and Gigabud are packed with dpt-shell. |
| T1453 | Abuse Accessibility Features. Gigabud abuses Accessibility service to enable device remote control. |
| T1417.002 | Input Capture: GUI Input
Capture. Fake banking login overlays; invisible lock screen PIN capture |
| T1418 | Software Discovery. Full app inventory uploaded on first activation |
| T1426 | System Information Discovery. Both Gigabud and Vwork have dedicated OEM-specific code branches. |
| T1513 | Screen Capture. Gigabud capability used to understand payment flow and during remote device access. |
| T1437 | Application Layer Protocol. Gigabud uses RTMP for video streaming. |
| T1437.001 | Application Layer Protocol:
Web Protocols. Gigabud uses HTTPS for C2 communication and WebSocket for video streaming. |
| T1521.001 | Encrypted Channel: Symmetric Cryptography. Gigabud encrypts its C2 payload/commands with its cipher (AES-ECB) before putting it inside an HTTPS request. |
| T1646 | Exfiltration Over C2 Channel. Gigabud exfiltrates data over the C2 channel. |
| T1509 | Non-Standard Port. Gigabud uses port 9000 for HTTPS and 8888 for WebSocket. |
| T1516 | Input Injection. Gigabud abuses Accessibility Services to perform gestures on the victim’s behalf. |
Indicators of Compromise (IOCs)
Gigabud
- b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501
- ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae
- 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc
- 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf
- 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611
- 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c
- 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3
Vwork
- 66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb
Modified Banking Application
- 61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc
DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.
Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.
This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.
This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.
All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.