Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan has developed a new tactic to evade detection by malware checks in banking apps. It installs a second Android app that creates a work profile on an infected phone. This work profile is a separate space on the device, typically used for employer apps, which keeps its contents isolated from the personal space. By dropping a tampered banking app inside this work profile, the trojan attempts to hide from malware checks. This behavior was reported by security firm Group-IB in a recent publication.