GoldFactory Hits Southeast Asia with Modified Banking Apps Driving 11,000+ Infections

Cybersecurity researchers have linked a financially motivated group known as GoldFactory to a fresh wave of mobile-targeted attacks in Southeast Asia, with Indonesia, Thailand, and Vietnam as the primary targets. According to Group-IB, the operation, observed since October 2024, spreads modified banking apps that act as Android droppers for remote access trojans, after impersonating government entities and trusted local brands and luring victims via links sent on messaging apps such as Zalo.

The campaign has produced more than 3,000 artifacts that resulted in at least 11,000 infections, while over 300 unique modified banking app samples have driven almost 2,200 infections in Indonesia alone; about 63% of the altered apps target the Indonesian market.

The attackers utilise three malware frameworks—FriHook, SkyHook, and PineHook—to hook into apps and enable abuse of accessibility services for control, with the eventual payloads including Gigabud, MMRat, or Remo accessed through fake Google Play Store pages. In one documented case, fraudsters posed as Vietnam’s EVN, instructing victims to pay bills and to add the attackers on Zalo to receive the malicious link.

Group-IB notes a likely evolution, including a pre-release Gigaflower variant and a shift away from a bespoke iOS trojan toward Android-focused campaigns that bypass traditional detection and scale rapidly.