This Malware Doesn't Hack Your Banking App. It Quietly Clones It.

Most banking malware tries to steal your login and get out before anyone notices. Researchers at Group-IB just documented an Android Trojan, Gigabud, that does something stranger: it makes a second, hidden copy of your actual banking app on your own phone — and commits fraud from inside that copy, in a place your bank's fraud detection may never think to look.

The trick is a feature, not a hole

Android has a legitimate feature called work profiles — a way to keep a second, isolated set of apps on one phone, normally used to separate work apps from personal ones. Gigabud abuses this by installing a malicious tool called Vwork, disguised as a legitimate open-source app-isolation utility, which quietly creates a new work profile, clones your banking app into it, and hides its own launcher icon so you'd never know it's there.

From that cloned profile, the attacker can carry out transactions directly — with the option to hide the activity behind a black screen while it happens. Because Android treats separate profiles as isolated from each other, a security tool that catches malware running in your personal profile has no reason to connect that to a transaction happening in a completely different profile it isn't watching.

How it actually gets on your phone

None of this works without you installing something first. Victims are lured into sideloading a fake airline, tax, delivery, or government app — usually through a phishing text, a fake ad, or a link shared on social media. Once installed, it asks for Accessibility access and permission to "display over other apps." Those two permissions are doing a lot of work: they're what let it show fake login overlays to steal your banking credentials and PIN, and later, silently spin up the cloned profile.

What to actually do

• Only install banking apps from the official Play Store or App Store, never a sideloaded APK from a link
• Treat any unsolicited prompt to install an app outside the store as a red flag, whatever it claims to be
• Never grant Accessibility access or "display over other apps" to an app that has no real reason to need it
• If you notice a second copy of your banking app you didn't install, or a work profile you didn't set up, stop using the phone for banking and contact your bank through a number you already trust — not one from a text or pop-up

More from Offgrid Studio

Stories like this are a good reminder of why we're careful about what our own apps ask for. OffgridStem, OffgridScribe, and OffgridVox don't request Accessibility access or overlay permissions — there's no reason a stem separator or a transcription tool would ever need them.