Indonesia Android Users Targeted by Banking App-Cloning Campaign Exploiting Work Profile

A new Android banking malware campaign has been detected in Indonesia, leveraging the Android Work Profile feature to distribute the Gigabud Trojan through cloned banking applications. The campaign, attributed to the threat group GoldFactory, was reported on September 11, 2026, by Dark Reading. In parallel, another malware family, Mantax Otax, is spreading separately, though details on its distribution remain limited.

The attack exploits Android's Work Profile, a feature designed to separate work and personal data on devices, to host and deliver malicious payloads. By abusing this legitimate functionality, the attackers can bypass some security controls and increase the likelihood of successful infection. The cloned banking apps are designed to mimic legitimate banking applications, tricking users into entering credentials and financial information, which are then harvested for financial theft.

The campaign primarily targets Android users in Indonesia, with potential impacts including unauthorized access to bank accounts, theft of funds, and compromise of personal data. The exact infection vector and full scope of Mantax Otax activity have not been independently verified, but the presence of two distinct malware families indicates a coordinated or opportunistic threat landscape.

Google and Android security updates are expected to address the Work Profile abuse, but users are urged to take immediate precautions. Recommendations include avoiding sideloading apps, downloading only from official app stores, enabling Google Play Protect, and being cautious of unsolicited requests for banking credentials.

Organizations with Android devices in Indonesia should review their mobile security policies, ensure that Work Profile configurations are properly managed, and educate users about the risks of installing apps from unofficial sources. Security teams should monitor for indicators of compromise related to Gigabud and Mantax Otax and implement detection rules to identify suspicious activity.