Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan leverages Android's legitimate work profile feature as a hiding mechanism, creating an isolated environment where a tampered banking app can operate outside the reach of standard security scans. This represents a sophisticated abuse of a trusted OS feature, demonstrating how attackers increasingly weaponize built-in platform capabilities rather than relying solely on traditional exploitation techniques. The attack chain — confirmed on real infected devices in Indonesia — allows credential theft and fraudulent transactions to proceed undetected. This matters because it highlights a critical gap: mobile security tools that rely on surface-level app scanning can be completely bypassed when malware manipulates the device's own profile architecture. Users and organizations that lack mobile threat defense (MTD) solutions or device management policies are particularly exposed.