Rather than relying solely on overlay attacks or accessibility abuse, the malware now installs a second Android application whose job is to set up a work profile on the infected device. Work profiles are the isolated containers Android normally reserves for employer-managed apps, keeping their data and activity walled off from everything in the personal space. Gigabud abuses this separation by dropping a tampered banking app inside the work profile, where it can operate outside the visibility of protections running in the user's personal environment.

That architectural gap is the heart of the trick: banking apps tend to check their own container for signs of tampering, hooks, or suspicious siblings, but the work profile presents a boundary they are not designed to inspect across. A modified app planted on the other side of that boundary can appear legitimate to checks running in the personal space.

Key points so far:

• The second app's sole purpose is creating the work profile and placing the rogue banking app within it.
• The approach exploits the isolation between work and personal profiles that Android provides for enterprise use.
• Group-IB attributes the activity to Gigabud, a known Android banking trojan.

No specific CVE identifiers or affected app versions were disclosed in the report, and the publication does not name the targeted banking applications or geographic regions involved. Readers should watch for follow-up technical analysis from Group-IB, which typically publishes indicators of compromise and detection guidance alongside its campaign reports.

Source: The Hacker News

Does your organization allow work profiles on BYOD devices, and would that policy help or hinder detection of this kind of abuse?