Gigabud Banking Trojan Exploits Android Work Profiles to Evade Detection

According to a report published by Group-IB on September 9, 2026, the Gigabud banking trojan has evolved its infection strategy. The malware now installs a secondary Android application that creates a work profile on the infected phone. Within this work profile, a tampered banking application is deployed. Android work profiles are a feature typically used by employers to separate corporate data from personal data, but the trojan abuses this isolation to hide the malicious banking app from the personal space and from security solutions that primarily scan the primary user space. The report, cited by The Hacker News, indicates that this technique allows the trojan to potentially bypass security checks and trick users into entering credentials, leading to financial fraud and data theft. As of the report date, no specific patch has been issued by Google; mitigation advice focuses on user caution when installing applications and the use of security solutions capable of detecting work-profile-based anomalies.