# Gigabud Flips Android's Own Security Feature Into a Hiding Spot for Fake Banking Apps
Android's work profile system was built to keep employer apps sealed away from personal data. Gigabud just figured out how to weaponize that seal in reverse.
According to a Group-IB report published September 9, the Gigabud banking trojan has added a second-stage payload: a dropper app that programmatically creates an Android work profile on the infected device, then installs a tampered banking app inside it. The result is a fraudulent banking client sitting in a sandboxed environment that most mobile security tooling — including the legitimate banking app's own fraud detection — has no visibility into.
## What a Work Profile Actually Does
Android's work profile feature was designed for enterprise BYOD scenarios. IT departments use it through Mobile Device Management solutions to create a walled garden where corporate apps live separately from personal ones. The personal profile can't read what's in the work profile. More importantly for Gigabud's purposes: security apps installed in the personal profile can't inspect what's running in the work profile either.
That bidirectional isolation is the point. For employees, it means their company can wipe work apps without touching personal data. For Gigabud, it means the tampered banking app it drops into the work profile is invisible to mobile antivirus scanners, invisible to the real banking app's overlay and environment checks, and invisible to the user who assumes everything in their personal space is clean.
The dropper creates the profile programmatically. Most users have never seen a work profile on their device and have no frame of reference for what one looks like appearing unexpectedly. The interface cues are subtle.
## The Fraud Detection Problem
Banking apps have invested heavily in runtime integrity checks over the last several years. Overlay attack detection, root detection, emulator detection, accessibility service auditing — these have driven earlier mobile banking trojans to constantly evolve their evasion stack. Gigabud's work profile maneuver sidesteps the entire category at once.
When the tampered banking app runs inside the work profile, it's executing in what the OS treats as a separate, legitimate user environment. The fraud signals that banks rely on — checking whether other suspicious apps are installed, whether accessibility services are enabled, whether the device has been modified — are queried within the profile's context. If the work profile looks clean, the checks pass.
The actual credential theft happens where the bank's detection can't see.
This matters because it's not just Gigabud that can do this. Work profile creation APIs are available to any app that requests the right permissions. The technique itself is now documented and public.
## How Devices Get Infected
Gigabud has historically spread through phishing pages that impersonate regional government agencies, immigration portals, and airline loyalty programs — particularly targeting Southeast Asian users, though Group-IB has tracked expansion into other markets. The initial dropper typically arrives as a sideloaded APK, exploiting the fact that users in some regions routinely install apps outside the Play Store.
The two-stage structure here is notable. The first app requests permissions and establishes persistence. The second — the work profile creator — is what does the evasion heavy lifting before finally installing the tampered banking client. This kind of staged architecture makes early-stage detection harder, because the first app may not exhibit obviously malicious behavior before the profile is in place.
## What Defenders Should Know
Mobile security teams and banking fraud units have a narrow window to adapt before this technique proliferates. A few concrete pressure points:
MANAGE_DEVICE_POLICY permissions or invoking DevicePolicyManager outside of an enterprise context deserves immediate scrutiny.## HackWire Analysis
What Gigabud has done here is philosophically interesting in a way that goes beyond the technical trick itself: it's turned Android's most mature enterprise security isolation feature into a malware refuge. That's not a new pattern — attackers have been abusing legitimate OS capabilities for years, from Windows services to macOS launch agents — but the work profile angle is particularly sharp because it exploits *trust* that the OS has deliberately built in.
The broader trend is worth naming. Banking trojans targeting Android have been on a multi-year arc of detection evasion sophistication. The early wave (2019–2021) leaned heavily on accessibility service abuse. Banking apps and Google both cracked down. The next wave moved to screen capture and overlay techniques. Those got patched too. Now we're seeing architecture-level evasion — not fooling a single security check but redesigning the infection's topology so the checks don't have jurisdiction.
The defenders' problem is structural: banking app fraud detection was designed assuming the app runs in a coherent, single-profile environment. That assumption is now exploitable. Patching this won't be a single APK update — it requires rethinking what attestation means when the OS itself provides legitimately isolated environments.
Group-IB hasn't disclosed which banks are specifically being impersonated in current campaigns, but Gigabud's historical targeting of Southeast Asian financial institutions and its expansion trajectory suggest this is an active, evolving operation. Any bank with significant mobile-first customer bases in those markets should be treating this as a near-term threat, not a watch item.
The technique is now documented. Expect imitation.
— *HackWire Editorial*
---