🚨 Group-IB uncovers Vwork, a weaponized fork of the open-source Android app cloner Shelter, used alongside the Gigabud banking trojan.

Vwork abuses Android Work Profiles to clone banking apps into an isolated environment, helping attackers evade detection and bypass fraud controls.

Vwork-compatible Gigabud samples were identified across LATAM, MENA, and APAC, targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, the Philippines, Thailand, Türkiye, and a GCC member state.

In Indonesia, Group-IB observed 1,469 compromised devices and 1,281 potentially compromised logins between February and July 2026, with estimated losses of $960,939.

Read the full technical analysis.

#ThreatIntelligence #AndroidMalware #Vwork #Gigabud