Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks
-
The Gigabud banking trojan has evolved a new evasion technique that leverages a core Android feature to slip past the security checks built into banking apps, according to research from Group-IB published on September 9.
Rather than relying solely on overlay attacks or accessibility abuse, the malware now installs a second Android application whose job is to set up a work profile on the infected device. Work profiles are the isolated containers Android normally reserves for employer-managed apps, keeping their data and activity walled off from everything in the personal space. Gigabud abuses this separation by dropping a tampered banking app inside the work profile, where it can operate outside the visibility of protections running in the user's personal environment.
That architectural gap is the heart of the trick: banking apps tend to check their own container for signs of tampering, hooks, or suspicious siblings, but the work profile presents a boundary they are not designed to inspect across. A modified app planted on the other side of that boundary can appear legitimate to checks running in the personal space.
Key points so far:
- The second app's sole purpose is creating the work profile and placing the rogue banking app within it.
- The approach exploits the isolation between work and personal profiles that Android provides for enterprise use.
- Group-IB attributes the activity to Gigabud, a known Android banking trojan.
No specific CVE identifiers or affected app versions were disclosed in the report, and the publication does not name the targeted banking applications or geographic regions involved. Readers should watch for follow-up technical analysis from Group-IB, which typically publishes indicators of compromise and detection guidance alongside its campaign reports.
Source: The Hacker News
Does your organization allow work profiles on BYOD devices, and would that policy help or hinder detection of this kind of abuse?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login