Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan now installs a second Android app that creates a work profile on an infected phone and drops a tampered banking app inside it, security firm Group-IB said in a report published on September 9. A work profile is a separate space that Android typically reserves for employer apps, and what's inside it is kept separate from everything in the personal space. That

Report facts: The Gigabud banking trojan now deploys a second Android app that creates a work profile on infected devices and installs a tampered banking app inside that isolated space, helping the malware evade standard banking app integrity and security checks. This technique targets mobile banking environments, undermining users’ trust in the authenticity of the banking app and its runtime protections. RealGround analysis: While the article does not explicitly mention AI, fintech ecosystems increasingly embed AI-driven fraud detection and behavioral analytics in mobile banking apps, which can be blinded or bypassed if malware runs inside deceptive app instances or segregated profiles. Financial institutions should conduct structured AI Security Readiness Assessments to ensure their AI-powered risk engines and app integrity checks monitor for profile-based evasion techniques and anomalous app installations, and to harden mobile AI telemetry against tampering in work-profile or containerized environments.