Gigabud Trojan Uses Android Work Profiles for Fraud

The Gigabud banking Trojan has developed a new method to hide from security checks of banking apps. According to a report by the security firm Group-IB, published on September 9, 2026, the Trojan installs a second Android app that creates a work profile on the infected device. This work profile is a separate area typically reserved for corporate applications, isolating the data contained within it from the user's personal data.

The use of work profiles allows the Trojan to place a manipulated version of a banking app within this protected area. This makes it more difficult for the security mechanisms of banking apps to detect the threat. The malware can thus access sensitive information unnoticed while simultaneously giving the impression that the device is secure.

Technical Details of the Gigabud Trojan

The Gigabud Trojan has proven to be particularly dangerous in recent months. The malware employs a variety of techniques to disguise itself and obscure its activities. The installation of the second app typically occurs without the user's knowledge, complicating detection by antivirus programs. Group-IB's security researchers have found that the malware specifically targets users who have banking apps installed on their Android devices.

Another concerning feature of the Gigabud Trojan is its ability to self-update. This means that the malware can continuously learn new functions and techniques to enhance its effectiveness. Researchers have also found that the Trojan is capable of stealing data from various banking apps, making it a serious threat to users' financial security.

The security firm Group-IB has urged users to be particularly cautious and to regularly check their devices for suspicious activities. In particular, users should be alert to any unknown apps installed on their devices that they did not download themselves. The use of security software is also recommended to detect potential threats early.

Reactions from the Security Community

The discovery of the Gigabud Trojan has raised concerns within the security community. Experts warn that the use of work profiles by malware represents a new dimension of threat. This technique could potentially be adopted not only by the Gigabud Trojan but also by other malware variants, further exacerbating the security situation for Android users.

Security researchers emphasize the need for both users and developers of banking apps to remain vigilant. It is recommended that developers regularly review and update their security protocols to ensure they are equipped against such new threats. Collaboration between security firms and app developers could be crucial in preventing the spread of such malware.

Reports about the Gigabud Trojan are part of a larger trend where cybercriminals are increasingly employing sophisticated techniques to carry out their attacks. The security firm Group-IB has already documented several similar incidents that point to the growing threat posed by banking Trojans. Users should be aware of the risks and take appropriate measures to protect their data.