LEGALAUDIT

Scam Radar

How can you recognize Android banking trojan Gigabud hides cloned banking apps in work profiles to commit fraud?

Published

Listen to the episode

TLDR

Gigabud is an Android banking trojan that tricks users into sideloading a fake airline, tax, or government app via phishing sites or messages. Once installed, it requests Accessibility access, overlay permission, and battery optimization...

How it works

Gigabud is an Android banking trojan that tricks users into sideloading a fake airline, tax, or government app via phishing sites or messages. Once installed, it requests Accessibility access, overlay permission, and battery optimization...

Red flags

  • Unsolicited SMS, email, or social media message asking you to install an APK outside the Play Store. An airline, tax, delivery, or government app asking for Accessibility or "display over other apps" permissions. A second, unexpected work profile or duplicate banking app appearing on your device

What to do

  1. 1Install banking and other apps only from the official store or the publisher's direct website
  2. 2never sideload APKs. Run any suspicious request to install an app through Malwarebytes Scam Guard before acting. If you already granted Accessibility to a shady app, co

Source

malwarebytes

Source reviewed by Mythos Forensic Team

https://www.malwarebytes.com/blog/mobile/2026/09/android-malware-creates-a-hidden-copy-of-your-banking-app

FAQ

Is Android banking trojan Gigabud hides cloned banking apps in work profiles to commit fraud a real scam pattern?

Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.

What are the first warning signs?

Unsolicited SMS, email, or social media message asking you to install an APK outside the Play Store. An airline, tax, delivery, or government app asking for Accessibility or "display over other apps" permissions. A second, unexpected work profile or duplicate banking app appearing on your device

What should I do first?

Install banking and other apps only from the official store or the publisher's direct website; never sideload APKs. Run any suspicious request to install an app through Malwarebytes Scam Guard before acting. If you already granted Accessibility to a shady app, co

Can LegalAudit check my case?

Yes. Start a free chat and paste the message, link, sender, or payment details for triage.