Vwork: Weaponized Open-source Software as an Addon for Gigabud

Introduction

During the “Hook for Gold” research, Group-IB discovered an application called Vwork that was installed within minutes after initial Gigabud infection along with tampered banking applications. Trials to find a sample of Vwork lead to Gigabud samples that are intentionally built to interact with Vwork. The significance of this finding meant that Vwork on infected devices cannot be considered a coincidence anymore. This article reveals what Vwork is, and how it is related to Gigabud.

What is Gigabud? Gigabud is an Android remote access banking trojan active since 2022. Currently it is detected in attacks across Southeast Asia, South Asia, Middle East, Africa and Latin America. Group-IB attributes Gigabud development to the GoldFactory group. The lure varies by region, impersonating national airlines, tax authorities, or government portals. Once installed and granted permissions, it gives its operator live remote control of the victim’s phone.

What is Vwork? Vwork is a fork of the open-source Android cloning application Shelter. Both Vwork and Shelter utilize the Android Work Profile feature to create isolated application space. While Shelter is implied to be operated manually by the device owner, Vwork exposes controls as an API allowing third-party applications perform cloning and related application management. Details on differences between Shelter and Vwork are in the Technical Analysis section.

How do they relate? Vwork doesn’t have its own C2 communications function, so it requires an external application installed on the same device. According to Group-IB Fraud Protection telemetry, Vwork is installed on victim devices after Gigabud to clone banking applications into the work profile. Gigabud sample analysis revealed new C2 commands specifically to operate with Vwork. Running the application inside the work profile hides Gigabud in the personal profile from signature detection in the application security SDK.

Key discoveries

• A new defense evasion technique in Android banking malware: cloning target applications into a managed profile with help of Vwork.
• Vwork is a weaponised copy of an open-source app Shelter, a cloning app that utilises Android Work Profile feature.
• GoldFactory group has incorporated Vwork into their arsenal and using it with Gigabud.
• Gigabud and Vwork infection chain confirmed on devices in Indonesia.
• Gigabud samples with Vwork capabilities found targeting Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, Philippines, Thailand, Türkiye, and a GCC member state.

Who may find this blog interesting:

• Cybersecurity analysts and corporate security teams
• Malware analysts
• Threat intelligence specialists
• Cyber investigators
• Fraud Analysts
• Law enforcement investigators
• Cyber police forces

Group-IB Threat Intelligence and Fraud Protection Portals:

Group-IB customers can access our Threat Intelligence and Fraud Protection portals for more information about the GoldFactory threat actor, Gigabud and Vwork malware described in this blog:

• GoldFactory Fraud Intelligence
• GoldFactory Threat Intelligence
• Vwork Fraud Intelligence
• Vwork Threat Intelligence
• Gigabud Fraud Intelligence
• Gigabud Threat Intelligence

Victimology And Impact

Since Vwork is not observed to be a standalone application but a companion for Gigabud, and Gigabud is the Android malware targeting mainly financial services such as banking and crypto, it suggests that the target industries are the same though only banking is confirmed within Group-IB data presented in this report.

Gigabud samples compatible with Vwork have been identified targeting the following countries: Brazil, Colombia, Egypt, Indonesia, Laos, Mexico, Morocco, Philippines, Thailand, Türkiye, and a GCC member state.

In Indonesia alone, from Feb – Jul 2026, about 1,469 compromised devices and 1,281 potentially compromised logins have been observed by Group-IB researchers, with an estimated loss of roughly USD $960,939. These figures reflect observed activity and should be considered indicative rather than representative of the full impact in the region.

Figure 1. Gigabud and Vwork fraud scheme flowchart.

1. Delivery – Employing social engineering through phishing sites, direct messenger apps, or social media, victims are let to install fake apps–disguised as legitimate airline, tax authority, or government services–containing the Gigabud malware outside of official app stores. 
2. Permission request – On first launch, Gigabud asks for Accessibility access, permission to draw over other apps, and an exemption from battery saving. Granting Accessibility is the moment the operator gains real control of the device.
3. Check-in – Gigabud sends a full list of every app installed on the phone back to the operator to identify specific banking targets, allowing more focused attacks instead of targeting every bank, then opens a live connection to the operator’s server and waits for instructions.
4. Credential theft – When the victim opens their real banking app, a fake login screen appears on top of it and captures whatever is typed. A separate, invisible overlay also captures the phone’s lock screen code.
5. App cloning – The operator tells Gigabud to install Vwork. Gigabud sent a command to Vwork to clone a specific app into its hidden work area. In one of the confirmed cases observed through this research, the copy was a fake version of a real Indonesian bank’s app.
6. Fraud and cash out – With full remote control, and where relevant a cloned banking app in place, the operator carries out transactions directly on the victim’s phone while a black screen hides what is happening. A cloned environment is used to evade fraud protection controls. If this environment is installed and not detected, fraud transactions may bypass monitoring and result in unauthorized cash-out.

Why Vwork

Applications installed in one Android profile are generally isolated from those in another profile, especially for signature-based malware detection. As a result, malware detected in a personal profile does not necessarily trigger an alert for the same malware activity in a separate work profile, let alone if that work profile is created after the initial malware installation.

Fraudsters exploit this isolation to evade detection. They first install the malware in the victim’s personal profile but do not immediately perform unauthorized transactions there. Although the bank may detect suspicious activity, the absence of an associated financial loss may prevent further action.

The fraudster then uses Vwork to create a separate work profile and clones the targeted banking application into it. Transactions are subsequently conducted from the newly created work profile.

From the bank’s perspective, the transaction originates from a new device and may appear unrelated to the previously detected malware activity. Meanwhile, the malware detection alert has already been triggered in the victim’s personal profile but will not fire in the newly created work profile due to a lack of infection signals.

By exploiting this separation between profiles, fraudsters can effectively break the link between the malware detection signal and the fraudulent transaction, allowing them to evade existing security controls and successfully cash out.

Infection Chain Captured by Group-IB Fraud Protection:

Figure 2. The initial Gigabud installation.

Figure 3. Shortly after, Vwork package is observed to be installed next.

Figure 4. Thirdly, the fake banking app is installed.

Technical Analysis

The matching architecture and class names provide strong evidence that Vwork is a fork of the open-source Android application Shelter, with additional modifications and interfaces introduced to support malicious capabilities.

The analyzed Vwork sample appears to be from an active development stage. Some of the newly introduced capabilities remain unstable and do not behave as intended on AOSP-like Android builds. At the same time, several OEM-specific code branches appear to be bug fixes for the upstream Shelter codebase.

The key differences between Vwork and Shelter are outlined below:

• Shelter’s cross-profiles intent signatures are removed allowing any application to interact with Vwork.
• Shelter’s cross-profile file exchange is changed in a way so that Vwork serves read/write files capability for any application within the same profile.
• Vwork ensures sideloading is allowed and Accessibility service is restricted in the provisioned profile.
• Two new exported components exposing four primary actions: start work profile provisioning, clone applications, list cloned applications and open arbitrary application.
• Vwork cloning capability requires authorization with an external server. Vwork performs authorization flow using server address and token provided from a third-party application (Gigabud) along with target package name.

Figure 5. Architecture similarities between Shelter (left) and Vwork (right).

Compared to Shelter, the multi-step user awareness activities are flattened to a single screen prompt during Vwork’s work profile setup (as shown in Figure 6 below). The Chinese-language text translates to “Welcome to Vwork. Tap ‘Activate now’ and it will guide you through setting up the work profile.”  After installation, the Vwork icon is also not shown in the launcher. Despite this, victims can still spot the application in the file manager (also Figure 6) due to the fact that Vwork still acts as a document provider.

Figure 6. Vwork installation prompt (with English translation), and its icon in the File Manager as a document provider.

While the core architecture of the UI remains unchanged from Shelter, Vwork’s UI is trimmed and translated to Chinese. UI text is rebranded from work profile language to virtual space. Internal settings control is also fully delegated to external applications and is not available in the UI anymore.

In summary, these changes make Vwork’s presence less visible to device owners and expose its cloning functions as an API to external apps. Shelter is primarily operated through a UI, and we can conclude that its repackaging to Vwork is a deliberate attempt to weaponise device owner-controlled cloning to third party application-operated cloning in order to facilitate malicious activity.

Connection with Gigabud

Some Gigabud samples discovered during “Hook for Gold” research were observed to declare the Vwork package name, net.yy.vwork, in the queries element of the Android Manifest along with old QUERY_ALL_PACKAGES permission.

These Gigabud samples have explicit interaction with Vwork. Old core logic C2 command openAPPList and app inventory mechanism now have dedicated code branches to interact with Vwork. Package names in such cases are prefixed with vwa- in C2 messages, i.e. vwa-com.example.application. Additionally there are three new C2 commands that primarily interact with Vwork: initVwa, cloneApp, uploadCloneApps.

As per above, cloneApp operation relies on an external authorization server. Gigabud implements logic to obtain that token from an exfiltration server suggesting this server is able to carry out Vwork authorization.

Threat Actor Attribution

Vwork was detected in the wild only in the “Hook for Gold” campaign which Group-IB has attributed to GoldFactory.

Technical analysis of the Vwork sample reveals a dedicated code branch references to Gigabud package names while showing overlapping network indicators and developer logs in Chinese.
This data is sensitive and cannot be published publicly, but Group-IB customers can view these indicators on our Threat Intelligence portal.

From these facts, we can conclude that Gigabud is not just built to interact with Vwork, but both of them are developed or customized by the GoldFactory group.

Detection and Prevention

The earliest reliable warning in this chain arrives well before any credential theft: an ordinary consumer phone, one that was never set up by an employer’s IT department or by the user themselves, suddenly creating an isolated work profile is already unusual on its own. Behavioral breakdowns include:

• An isolated environment / work profile appearing on a phone that was not intended by the user.
• Identical banking application installation markers across profiles.
• An isolated, clean environment with no common legitimate user apps (e.g., banking, messaging, or social media), designed to conceal malicious activity.
• Accessibility access enabled for an app that should not require them.
• A device management feature being used to grant an app control over every other installed app, with no approval screen shown, something no legitimate consumer tool has a reason to do.
• An unexpected app installation from a non-legitimate source landing on the phone within a short period from a previous app install.

Group-IB Fraud Protection correlates these signals together and treats two or more appearing in the sessions as high risk, sufficient to block a transaction directly. Device binding and key signing controls separately stop stolen logins from being used to authorize transactions on an attacker controlled device, regardless of whether an earlier stage was caught.

Conclusion

Gigabud and Vwork show a deliberate choice by one operator to split a single scheme into two separate tools, one to take over the phone and one to manage work profile. Splitting the work this way allows the malicious application to stay in an isolated profile hidden from signature-based malware detection engines. It also shows how easily legitimate software can be abused. The early warning for defenders are the unusual use device profile, combined with suspicious app-cloning behavior, either a banking app impersonation, or a genuine but outdated app sideloaded outside the official app store.

Recommendations

For end users:

• Install apps only from official stores, refuse Accessibility access for any app that is not an accessibility tool, and use a second factor that does not rely on SMS for banking and crypto apps.

For banks and wallet providers:

• Tie logins to a specific trusted device, watch for unusual timing and ordering of actions within a session, and block transactions from any device showing active Accessibility access on an unrecognised app.

For security vendors:

• Implement both signature-based and behavioral detections such as Group-IB Fraud Protection platform. Fraudsters are evolving and sticking to only one method is insufficient to detect malicious activity in time.

For regulators and government:

• Require official apps to be distributed only through verified stores, and remind users publicly that a legitimate app is never shared as a raw file inside a chat app.

Acknowledgement of Research Support

• Yuan Huang, Global Fraud Intelligence Lead
• Andrey Polovinkin, Team Lead Reverse Research

Group-IB Fraud Matrix

MITRE ATT&CK

Indicators of Compromise (IOCs)

Gigabud

• b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501
• ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae
• 4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc
• 112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf
• 9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611
• 1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c
• 0710ca983741bf6a95db1b6960c1985e45b10f276e5b26f4fae3157db283d1f3

Vwork

• 66499653c0fff78d81db5dc319b9aaa0288dc5d76f555a5eba73660c0ee810eb

Modified Banking Application

• 61274cf9f49e04e559b267d18617d352c48ba3b1f453773ee9f30e5a4e25dbbc

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.

Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.

This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.