This campaign distributes the Gigabud Android banking malware via cloned versions of the legitimate vWork app, using social engineering to trick users into installing the malicious apps from unofficial sources. Once installed, the malware abuses permissions and accessibility services to steal credentials and intercept sensitive financial data. The threat reinforces the need for user education on verified app sources and continuous mobile threat monitoring.
A recent investigation uncovered a mobile fraud campaign using cloned versions of Vietnam’s vWork application to distribute Gigabud, an Android banking malware linked to the GoldFactory threat group. Attackers impersonate legitimate services and use social engineering to convince victims to install malicious apps outside official stores. Once installed, the malware can abuse device permissions and accessibility features to steal credentials, intercept sensitive information, and support fraudulent financial activity. The campaign demonstrates how attackers are increasingly combining trusted brand impersonation, app cloning, and banking malware to compromise mobile users, reinforcing the importance of verified app sources and continuous mobile threat monitoring.