Gigabud banking trojan operators deployed a novel evasion technique that exploits Android's work profile feature to bypass banking app security checks. The malware now installs a secondary application that creates a containerized work profile on infected devices, then places a compromised banking application inside this isolated environment.
Group-IB disclosed the technique in a report published September 9. Work profiles function as separate logical spaces on Android devices, typically managed by Mobile Device Management (MDM) systems for corporate deployments. Applications running within work profiles operate under distinct sandboxing rules and are isolated from personal app data. Gigabud leverages this legitimate Android architecture feature to hide malicious banking apps from detection mechanisms.
The attack chain begins with installation of the primary Gigabud trojan. This malware then drops a secondary application designed specifically to instantiate a work profile on the target device. Once the work profile activates, Gigabud deploys a tampered version of legitimate banking applications into this containerized space. The separation between work and personal profiles creates detection blind spots. Most banking apps implement security checks that scan the primary personal space for known malware indicators or suspicious modifications. By operating within the work profile, the malicious banking app avoids these scans entirely.
This represents a significant evolution in mobile banking trojan tactics. Gigabud previously relied on straightforward code obfuscation and dynamic loading to evade detection. The work profile approach demonstrates a shift toward exploiting legitimate platform architecture. Rather than fighting detection tools directly, the malware hides behind features Android itself provides for enterprise security.
The implications for both organizations and individuals are substantial. Enterprise users face compounded risk. Corporations that permit personal device usage alongside official MDM deployments now operate in environments where Gigabud can create dual personas on the same phone. An employee's personal banking apps may appear clean to their device while a compromised version operates undetected in the work profile. Organizations cannot rely on standard Mobile Device Management alerts to catch this infection pattern.
Individual users encounter difficulty detecting Gigabud through conventional means. Standard antivirus scans often focus on the primary personal space. The work profile remains less visible in typical security audits. Users may see legitimate banking apps open normally while never realizing a backdoored version executes in parallel.
Gigabud targets users across multiple geographies and primarily focuses on stealing banking credentials and session tokens. The malware captures login information through keylogging and screen overlay attacks, then uses harvested credentials to initiate unauthorized transactions.
Defense against Gigabud's work profile technique requires updated detection logic. Mobile security vendors must scan application containers across all profiles, not just the personal space. Device administrators should disable work profile creation for personal devices unless explicitly managed. Users should install security updates immediately and disable installation from unknown sources in Android settings.
Google has not yet issued a platform-level mitigation for this specific abuse pattern. However, future Android releases may implement additional access controls around work profile creation by third-party applications.