Vwork: Weaponized Open-source Software as an Addon for Gigabud

Gigabud is an Android remote access banking trojan active since 2022, attributed to GoldFactory group, targeting victims across Southeast Asia, South Asia, Middle East, Africa and Latin America. The malware now utilizes Vwork, a weaponized fork of the open-source app cloning application Shelter, to evade detection by creating isolated work profiles. After initial Gigabud infection, Vwork is installed to clone banking applications into the work profile, hiding malicious activity from signature-based detection in application security SDKs. Between February and July 2026, approximately 1,469 compromised devices and 1,281 potentially compromised logins were observed in Indonesia alone, with estimated losses of roughly $960,939. The infection chain involves social engineering through phishing sites delivering fake apps disguised as legitimate services, followed by credential theft through overlays and remote-controlled fraudulent transactions executed within cloned banking apps.

• Hirudo: From Fake Updates to Patched Banking AppsMalware2026-10-14
• From BlackCat to Panda Workshop: Inside the Evolving C2 Panel Behind RATHatMalware2026-09-28
• RemControl: AI Built the Overlays. Victims Lose their PINsMalware2026-09-23
• What the Source Leak Says About HookBotMalware2026-08-25
• Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud SchemeMalware2026-08-12