Android Work Profile abuse is helping banking malware operators hide fraudulent activity on infected phones in Indonesia. The campaign combines Gigabud, a remote access banking trojan, with Vwork, a companion app that places banking applications inside a separate work profile.<\/p>\n
Group-IB observed approximately 1,469 compromised devices and 1,281 potentially compromised logins between February and July 2026. Estimated losses reached roughly $961,000. These figures describe observed activity, rather than the campaign\u2019s full regional impact.<\/p>\n
For enterprise IT teams, the incident raises a practical question: does your security assessment cover the environment where an application actually runs?<\/p>\n