As reported by Dark Reading, the GoldFactory threat group has launched an Android banking malware campaign in Indonesia that weaponizes the Android Work Profile feature to deploy the Gigabud banking trojan, while the Mantax and Otax malware families spread through separate delivery channels. This campaign deserves closer attention from defenders well beyond Southeast Asia — it reflects a broader evolution in mobile banking-malware tradecraft that is rapidly becoming relevant to enterprises globally.

Threat Alert: As reported by Dark Reading, the GoldFactory threat group has launched an Android banking malware campaign in Indonesia that weaponizes the Android Work Profile feature to deploy the Gigabud banking trojan, while the Mantax and Otax malware families spread through separate delivery channels.

Why This Matters

The abuse of Android Work Profile is the most technically significant element here. Work Profile was designed to separate corporate and personal data on managed devices, but attackers are exploiting its containerization to run malicious apps in an isolated space that is harder for mobile security tools to inspect and remediate. This is not a zero-day or a platform vulnerability — it's a legitimate feature being repurposed for persistence and evasion. That distinction matters because traditional MDM policies and endpoint detection often treat Work Profile boundaries as trusted management zones, not as potential threat surfaces.

GoldFactory's use of multiple trojan families — Gigabud, Mantax, and Otax — in parallel campaigns also suggests a modular, franchise-style operation. This is consistent with trends observed in banking-malware ecosystems like FluBot, Anatsa, and the revived Cerberus lineage, where code is shared, resold, and rapidly customized per regional target. Indonesia is a high-value proving ground: large mobile-first population, growing digital banking adoption, and regulatory environments that have historically lagged behind mobile threat velocity.

Broader Implications

  • BYOD exposure expands: Employees using personal Android devices for banking apps or corporate email are now dual-targets — financial loss and potential lateral credential compromise.
  • MDM/UEM gaps: Many UEM solutions do not deeply scan the Work Profile container for unmanaged or sideloaded applications, creating a blind spot.
  • Regional ripple effect: Successful campaigns in Indonesia typically migrate to Vietnam, Thailand, the Philippines, and India within 6–12 months. Western BYOD environments are secondary targets.
  • App-cloning as social engineering: The campaign uses cloned banking apps, meaning brand impersonation is doing the heavy lifting — not novel exploitation. User awareness remains underinvested.
Key Takeaway: The threat isn't a new Android vulnerability — it's the convergence of legitimate platform features, social engineering precision, and modular malware delivery. Defenders need to stop treating mobile as a solved problem.

Shield53 Recommendations

What You Should Do

Shield53 Recommendations
Audit UEM/MDM Work Profile policies: Ensure your MDM solution can inventory and block unmanaged/sideloaded apps inside the Work Profile container. If it can't, escalate with your vendor or evaluate supplementary mobile threat defense (MTD) tooling.
Deploy Mobile Threat Defense (MTD): Solutions from vendors like Lookout, Zimperium, or Pradeo can detect overlay attacks, sideloaded trojans, and Work Profile abuse that native MDM misses.
Block sideloading and unknown sources: Enforce Google Play Integrity attestation for any corporate-managed or BYOD Android device accessing corporate resources. Disable "Install unknown apps" for all but essential contexts.
Expand phishing training to mobile: Include app-store impersonation, SMS-based lures (smishing), and fake banking app scenarios in your security awareness program — not just email phishing.
Monitor for credential reuse: If employees use the same device for personal banking and corporate access, treat banking trojan compromise as a potential corporate credential exposure event. Integrate mobile threat signals into your SIEM.
Coordinate with banking partners: For financial sector CISOs specifically, share IOCs and app-impersonation patterns with regional financial ISACs. Speed of disclosure across banks is the best counter to franchise-style malware operations.

The GoldFactory campaign is a reminder that the mobile threat landscape has not plateaued — it has matured. Attackers are learning to live inside the features defenders rely on, which is exactly the pattern that has defined every successful threat evolution from cloud to identity to now mobile. Treat this as a leading indicator, not a regional curiosity.