GoldFactory's Android Banking Malware Exploits Work Profiles to Steal $1M from Indonesian Banks
Between February and July 2026, the Chinese-speaking threat group GoldFactory deployed a sophisticated Android banking malware campaign targeting Indonesia, resulting in 1,469 compromised devices and nearly $1 million in losses. The attackers used the Gigabud banking Trojan in combination with Vwork, a modified app-cloning tool, to exploit Android's Work Profile feature. This technique allowed fraudsters to clone legitimate banking applications into isolated environments where security controls and fraud detection systems could not follow, enabling them to conduct transactions while evading detection mechanisms that were triggered in the victim's primary profile. This incident highlights the evolution of mobile banking threats as attackers increasingly target regions with high mobile payment adoption and develop novel evasion techniques that exploit legitimate enterprise security features for malicious purposes.
Kill Chain
