Indonesia Hit by Android Banking App-Cloning Campaign

A sophisticated malware campaign targeting Android users in Indonesia has been identified, involving the cloning of legitimate banking applications. According to security researchers, the threat group known as GoldFactory is actively exploiting the Android Work Profile feature to facilitate the delivery of the Gigabud Trojan. By leveraging this legitimate system feature, attackers can bypass traditional security measures and gain unauthorized access to sensitive user data and financial credentials. Additionally, a separate threat actor identified as Mantax Otax is distributing malicious software through similar deceptive tactics. These campaigns highlight the evolving risks associated with mobile banking and the importance of verifying application sources. Security experts advise users to exercise caution when granting permissions to banking apps and to ensure their devices are updated with the latest security patches to mitigate the risk of exploitation by these malicious actors.