Gigabud Malware Abuses Android Work Profiles and Vwork App Cloning for Defense Evasion

The campaign shows how threat actors can abuse Android Work Profiles to separate malicious activity from the victim’s normal phone environment and evade banking-app security checks. Gigabud has been active since 2022 and is linked by Group-IB to the GoldFactory threat group . It targets users across Southeast Asia, South Asia, the Middle East, Africa, and Latin America. The malware commonly arrives through phishing websites, messaging apps, and social-media posts that…