Gigabud Banking Malware Hides Inside Android Work Profiles to Dodge Security Checks

Key points

• Group-IB published a report on September 9 detailing a new Gigabud Android banking trojan variant that abuses work profiles to hide a tampered banking app.
• The malware installs a second dropper app that creates the work profile, isolating the fake bank app from Android's usual security checks in the personal space.
• Victims are lured through fake job offers, dating scams and phishing sites impersonating banks and government services, chiefly across Southeast Asia.
• The fake banking app inside the work profile steals login credentials and card data, then relays them to the criminals.
• Install banking apps only from official stores and check your phone's settings for any work profile you didn't set up yourself.

A banking trojan called Gigabud has learned a new trick: it hides inside the part of an Android phone normally reserved for employer software. Group-IB described the technique in a report published on September 9. It's the most novel evasion method we've seen in this campaign category since we reported on Group-IB's SpyNote and WindRelay findings in August.

What is Gigabud actually doing?

The malware installs a second app on the phone. That second app creates an Android work profile, a separate walled-off space Android normally reserves for company-issued software, then drops a tampered banking app inside it.

Anything inside the work profile is sealed off from apps in the personal space. Security tools most people rely on, including Google Play Protect and the bank's own anti-fraud checks running in the main profile, can't easily see what the fake banking app is doing. Once inside, the tampered app behaves like the real bank, collecting login credentials and card details and sending them straight to the attackers.

How do people end up with it?

Victims install the first-stage app themselves. Group-IB says the lures include fake job adverts, romance scams on dating apps, and phishing pages dressed up as banks or government portals. Most targeting so far has been in Southeast Asia, with Thailand, Indonesia and the Philippines named in the research. The apps are sideloaded, meaning installed from a link or file rather than from the Google Play Store.

Why does the work profile trick matter?

Android work profiles exist for a legitimate purpose: letting a company put its apps on an employee's personal phone without mixing the two. The criminals have turned that same isolation against the user.

Fraud detection built into legitimate banking apps often checks the environment they're running in. A suspicious app running alongside them can trigger a refusal to open or flag the session. Put the malicious app in a separate profile and those checks come up clean. The user sees a normal-looking bank login and hands over their details. Banks that believe a scan of the personal profile is sufficient are working from an assumption this variant quietly invalidates.

Should you worry?

If you're in Southeast Asia and you've installed any app from outside the Play Store recently, yes, take a look. The sideloading requirement is the main limiting factor here: this campaign can't reach you through an app store alone.

For broader context, mobile banking trojans targeting the region have been arriving at pace. Our coverage of Rokarolla in June documented 137 remote commands in a single piece of malware, and the pattern since then hasn't slowed.

What should ordinary phone users do?

Stick to the Google Play Store for banking apps and be suspicious of any download link sent via message or from a contact you met online. If a job recruiter asks you to install a specific app to receive payments, stop. Check your phone's settings for any work profile or managed account you didn't create yourself. On most Android devices this sits under Settings then Accounts. If one's there and you didn't add it, remove it and run a scan.