CuraSec

Learn active

Gigabud Android Trojan Uses Work Profiles to Evade Banking App Checks

2026-09-10 14:58 UTC · The Hacker News · read the source ↗ #android-malware#banking-trojan#evasion
  • Engineer — Learn: Relevant if your organization develops or distributes Android banking apps; the work-profile sandboxing abuse is a novel evasion technique worth factoring into mobile app integrity checks and attestation logic.
  • SOC/IR — Learn: No IOCs or ATT&CK mappings are surfaced in this item, but the work-profile evasion mechanism is useful context for analysts triaging mobile endpoint alerts or evaluating MDM telemetry gaps.
  • Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment (CISA KEV / EPSS / public PoC). Verify against the original source before acting. Found a bad verdict? Report it — confirmed errors go to the corrections log.