Android Banking Trojan Gigabud Clones Apps in Hidden Work Profile to Conduct Fraud
What Happened — Researchers discovered that the Android banking Trojan Gigabud creates a malicious work profile on infected devices, clones the victim’s banking app into that profile, and conducts fraudulent transactions from the hidden environment. The malware is delivered via sideloaded apps that request accessibility, overlay, and battery‑optimization permissions.
Why It Matters for Trust & Control Assurance —
- Shows a concrete gap in mobile access‑control and work‑profile isolation that a continuous control‑assurance program must detect and document.
- Requires auditable evidence that permission grants and profile creation are governed by policy and logged for review.
- Directly tests the Access Control control objective, which maps to many frameworks (e.g., NIST CSF) and is supported by Verisq’s Access‑Control assurance capability.
Who Is Affected — Financial‑services customers using Android banking apps; any organization that relies on Android work profiles for data separation.
Recommended Actions — Review and tighten mobile device management (MDM) policies to block unauthorized work‑profile creation, enforce installation only from official app stores, and enable logging of permission grants and profile changes. Collect and map this evidence to your audit‑readiness framework. Source: Malwarebytes Labs
Technical Notes — Gigabud modifies the open‑source tool Shelter into “Vwork,” removes cross‑profile protections, and hides its launcher icon. The initial infection vector is phishing‑driven sideloaded apps that request Accessibility, overlay, and battery‑optimization exemptions. Source: Malwarebytes Labs