Gigabud Banking Trojan Uses Android Work Profiles to Evade Malware Detection

New Evasion Tactic for Gigabud Trojan

The Gigabud banking trojan has adopted a new technique to avoid detection by banking applications. According to a report by security firm Group-IB, the trojan now installs a secondary Android application that establishes a work profile on the compromised device. Within this isolated work profile, a modified banking application is then deployed.

Exploiting Android Work Profiles

Android work profiles are typically used by employers to separate work-related applications and data from personal content on a device. By leveraging this feature, the Gigabud trojan creates a barrier between its malicious components in the personal space and the banking app within the work profile. This separation prevents the banking app's built-in malware checks from detecting the trojan, allowing fraudulent transactions to proceed unnoticed by the user.

How the Trojan Operates

Gigabud, identified as a remote access trojan active since 2022 and linked to the GoldFactory group, initially infects devices through fake applications disguised as legitimate services like airlines or tax offices. Upon installation, it requests extensive permissions, including Accessibility access, which grants the operator full control. The trojan then identifies banking targets, overlays fake login screens to capture credentials, and can execute transactions while obscuring the activity with a black screen.

Vwork App Facilitates Isolation

The second application used by Gigabud to create and manage the work profile is named Vwork. Group-IB noted that Vwork's architecture resembles Shelter, an open-source tool that also utilizes work profiles for app isolation. However, unlike Shelter, which is manually controlled by the user, Vwork automates the setup of work profiles and the cloning of applications into them, enabling the trojan's stealthy operation.