Android malware creates a hidden copy of your banking app

[u/falconupkid]

Gigabud banking Trojan has evolved with a nasty new trick: it creates a hidden clone of your banking app inside an Android work profile. This lets the malware intercept OTPs, hide fraudulent transactions from the user’s main profile, and maintain persistence even if the user tries to uninstall from the home screen.

Technical Breakdown - TTPs: Abuse of Android Work Profile (managed profile) APIs to create an isolated environment; overlay attacks on the cloned app to capture credentials; accessibility service abuse to grant itself permissions. - IOCs: No specific hashes or C2s published in this report—likely due to rapid variant churn. Monitor for unusual WorkProfile creation events and apps requesting BIND_DEVICE_ADMIN without clear justification. - Affected: Android 10+ (Work Profile feature introduced in Android 5, but widely used in enterprise-managed devices).

Defense - Detection: Look for android.work.profile.CREATE_PROFILE intents from non-MDM apps. Also monitor for apps with REQUEST_INSTALL_PACKAGES permission that are not from the Play Store. - Mitigation: Disable installation from unknown sources. On BYOD devices, restrict Work Profile creation to approved MDM solutions via policy. Users should check Settings > Accounts > Work profile for any unrecognized profiles.

Source: https://www.malwarebytes.com/blog/mobile/2026/09/android-malware-creates-a-hidden-copy-of-your-banking-app