Gigabud uses Vwork to create Android work profiles that hide the trojan from banking app malware checks, with the chain confirmed in Indonesia.