A recent investigation uncovered a mobile fraud campaign using cloned versions of Vietnam’s vWork application to distribute Gigabud, an Android banking malware linked to the GoldFactory threat group. Attackers impersonate legitimate services and use social engineering to convince victims to install malicious apps outside official stores. Once installed, the malware can abuse device permissions and accessibility features to steal credentials, intercept sensitive information, and support fraudulent financial activity. The campaign demonstrates how attackers are increasingly combining trusted brand impersonation, app cloning, and banking malware to compromise mobile users, reinforcing the importance of verified app sources and continuous mobile threat monitoring.
Read the full report here.
