GoldFactory Gigabud banking trojan distribution campaign across 11 countries
Campaign
Summary
Hide ▲
Show ▼
The GoldFactory-linked Gigabud campaign now uses Vwork to create an Android Work Profile on infected phones and hide a tampered banking app from malware checks. Group-IB said the full chain was confirmed in Indonesia, while samples built for Vwork were seen targeting 11 countries; the report also tied the activity to fake airline, tax office, and government apps used as lures. Between February and July 2026, Group-IB observed about 1,469 compromised devices, 1,281 possibly compromised logins, and roughly $960,000 in estimated losses. The report says Vwork was found during earlier December 2025 research on the same GoldFactory campaign and was seen in the wild only in that thread.
Related Happenings
GoldFactory GoldDigger Android banking campaign targeting South Africa and the U.K.
Campaign
H score41
First: 20.08.2026 13:38
Last: 20.08.2026 13:38
Sources 1
About this happening:
A GoldDigger Android banking campaign is driving mass infections in South Africa and the U.K., using fake airline and shopping apps to steal credentials and trigge...
GoldFactory GoldDigger Android banking campaign targeting South Africa and the U.K.
CampaignAbout this happening: A GoldDigger Android banking campaign is driving mass infections in South Africa and the U.K., using fake airline and shopping apps to steal credentials and trigge...
Jewelbug multi-region government webmail espionage campaign
Campaign
H score56
First: 13.08.2026 21:15
Last: 13.08.2026 21:15
Sources 1
About this happening:
Jewelbug is a China-linked hack-for-hire campaign that paired government and military espionage with cryptocurrency fraud. The operation compromised 15 governmen...
Jewelbug multi-region government webmail espionage campaign
CampaignAbout this happening: Jewelbug is a China-linked hack-for-hire campaign that paired government and military espionage with cryptocurrency fraud. The operation compromised 15 governmen...
Latest development: 14.08.2026 10:54
Broadcom's Symantec and Carbon Black linked Jewelbug's espionage and crypto-fraud operations to XG-Web, a React/Node.js/MySQL control panel used to manage browser-based access, host obfuscated payloads in public Google Docs, and coordinate the com.microsoft.runedge native-messaging host to run operator commands. The analysis also described the malicious PDF Viewer extension for Google Chrome and Mozilla Firefox, and said the campaign targeted government organizations and militaries across the Middle East, Southeast Asia, and South Asia.
Jewelbug pairs espionage with industrial-scale cryptocurrency fraud
Threat Actor Meta
H score62
First: 13.08.2026 21:15
Last: 13.08.2026 21:15
Sources 1
About this happening:
Jewelbug is a China-linked threat actor operating a blended espionage and cryptocurrency fraud ecosystem. Broadcom’s Symantec and Carbon Black Threat Hunter...
Jewelbug pairs espionage with industrial-scale cryptocurrency fraud
Threat Actor MetaAbout this happening: Jewelbug is a China-linked threat actor operating a blended espionage and cryptocurrency fraud ecosystem. Broadcom’s Symantec and Carbon Black Threat Hunter...
Interpol-led Operation Synergia III cybercrime takedown
Law Enforcement
H score11
First: 13.03.2026 18:15
Last: 13.03.2026 18:15
Sources 1
About this happening:
Interpol coordinated Operation Synergia III, and the 94 arrests plus infrastructure seizures materially disrupted a cross-border phishing and ransomware case n...
Interpol-led Operation Synergia III cybercrime takedown
Law EnforcementAbout this happening: Interpol coordinated Operation Synergia III, and the 94 arrests plus infrastructure seizures materially disrupted a cross-border phishing and ransomware case n...
GoldFactory Coretax impersonation fraud campaign
Campaign
H score70
First: 19.02.2026 17:30
Last: 19.02.2026 17:30
Sources 1
About this happening:
The GoldFactory-linked fraud campaign now threatens Indonesian taxpayers at scale, with estimated losses of $1.5m to $2m. It ran from July 2025 and intensified in...
GoldFactory Coretax impersonation fraud campaign
CampaignAbout this happening: The GoldFactory-linked fraud campaign now threatens Indonesian taxpayers at scale, with estimated losses of $1.5m to $2m. It ran from July 2025 and intensified in...
Timeline
-
09.09.2026 17:30 3 articles · 13d ago
Gigabud clones banking apps into Android work profiles
Initial DisclosureGroup-IB said Gigabud was being paired with Vwork, a weaponized fork of Shelter, to clone banking apps into an Android Work Profile and separate malware alerts from the ensuing transaction. The researchers said the full infection chain was confirmed on devices in Indonesia, and that Gigabud samples built to work with Vwork were targeting 11 countries including Brazil, Colombia, Egypt, Mexico, Thailand and Turkiye. In Indonesia between February and July 2026, Group-IB observed about 1469 compromised devices, 1281 potentially compromised logins, and estimated losses of roughly $960,939.
Show sources
- Gigabud Uses Android App Cloning to Evade Fraud Detection — www.infosecurity-magazine.com — 09.09.2026 17:30
- Gigabud Uses Android App Cloning to Evade Fraud Detection — www.infosecurity-magazine.com — 09.09.2026 17:30
- Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks — thehackernews.com — 10.09.2026 14:33