A new threat has emerged in the world of Android banking app security, as a group called Gigabud has developed a technique to evade malware detection by creating work profiles on compromised devices. This clever tactic allows malicious actors to bypass security checks and continue to siphon sensitive information from unsuspecting users.
Gigabud’s method relies on exploiting Android’s built-in feature of multiple user profiles, which allows users to create separate work and personal spaces within a single device. By creating a work profile on an already compromised device, hackers can conceal their malicious activities from banking apps’ security checks, making it much harder for these apps to detect the presence of malware.
The technique works by separating the malicious application from the main user profile, essentially creating a “sandbox” environment that prevents traditional malware detection tools from flagging suspicious activity. This allows the hacker to continue operating undetected, stealing sensitive information such as login credentials and financial data without arousing suspicion. The compromised device’s legitimate owner may remain completely unaware of the ongoing threat.
The implications are significant: Gigabud’s method is a game-changer for attackers seeking to evade detection by banking apps’ robust security measures. It effectively neutralizes some of the most effective countermeasures put in place to protect users from financial loss. With this technique, hackers can target Android devices with greater ease and confidence.
Gigabud’s tactic also underscores the ongoing cat-and-mouse game between cybersecurity experts and malicious actors. As new methods emerge, security teams must adapt quickly to stay ahead of the threats. In this case, banks and financial institutions will need to reassess their security protocols and consider implementing additional measures to counter this new threat.
Practically speaking, users should be cautious when managing multiple profiles on their Android devices. It’s essential to remain vigilant about suspicious activity and monitor your accounts regularly for any signs of unauthorized access. By staying informed and taking proactive steps to protect your digital life, you can reduce the risk of falling victim to these types of attacks.
Source: The Hacker News — 2026-09-10