Attackers are targeting Indonesian mobile banking users with cloned Android apps that abuse the platform's Work Profile functionality. The campaign is linked to a group tracked as GoldFactory, which uses Work Profile to obfuscate the delivery of the Gigabud Trojan. The technique lets the malicious code run in a separate container, making it harder for users to detect suspicious activity.
A second group, Mantax Otax, is running a separate but parallel distribution effort with the same Gigabud malware. The existence of two active operators suggests the trojan's availability is expanding, even if the two campaigns are not directly coordinated.
This is the latest in a series of mobile banking attacks across Southeast Asia, where trojans are frequently disguised as legitimate bank apps. By leveraging Android's own Work Profile feature, the attackers avoid some common detection methods and add a layer of legitimacy to the malicious installations.