work profile Archives

AppWizard

October 19, 2026

Android Auto Might Soon Let You Use Apps From Your Work Profile

Google is enhancing its in-car software, Android Auto, to support professional applications, allowing users to receive notifications from their work profiles while driving. Recent code findings indicate that work profiles will soon be operable on car dashboards, enabling drivers to view calendar meetings and listen to messages from supervisors through their vehicle's audio system. This update will allow users to access business applications directly from their main console, improving productivity during commutes. An official release date for this feature has not yet been announced.

AppWizard

October 14, 2026

Android Auto 18 Now Available With Hidden “Cielo” Major Update Evidence

Google is preparing a significant update for Android Auto, with the latest version, Android Auto 18, currently in beta. The update, codenamed Cielo, represents the first major overhaul since Coolwalk and will introduce a new interface featuring widgets integrated alongside the main display. This design aims to maximize screen usage across various vehicle displays, including unconventional shapes like round screens. Android Auto 18 will also include a dynamic font called Google Sans Flex and enhancements to Work Profiles, allowing users to activate a work profile when connecting their phones to the vehicle. Additionally, the update will improve the capabilities of Gemini, which will leverage data from other Google services for contextual responses. Users can download the Android Auto 18.0 beta via an APK installer, but it is advised not to rely on this version for daily use due to potential issues.

AppWizard

September 24, 2026

6 ways Android Enterprise is evolving for the modern workforce

In modern workplaces, the balance between innovation and security is crucial as employees seek access to advanced technology while IT departments protect sensitive data. Android is enhancing its tools for workers through Android Enterprise, with key advancements expected by 2026, including: 1. Advanced AI agents and controls: - Smarter workflows will introduce next-generation AI agents with enterprise-grade controls. - The evolution of Gemini will enable management of complex workflows using real-time context, eliminating manual app switching. - Built-in safeguards will ensure work profile isolation, preventing personal agents from accessing corporate data. - Administrators will have granular control to configure or disable AI automation through Android Enterprise. 2. Next-gen manageable XR devices: - New hardware like the XREAL Aura wired glasses will enhance workforce capabilities. - IT administrators will manage a range of XR devices alongside standard mobile fleets using Enterprise Mobility Management consoles. - Employees will benefit from hands-free productivity with integrated displays, audio, and AI assistance while connected to enterprise tools.

AppWizard

September 11, 2026

NetScaler vulnerability exploited, AdaptHealth suffers breach, new Android malware

The Cybersecurity and Infrastructure Security Agency (CISA) warned of a critical vulnerability in NetScaler, identified as CVE-2026-19490, with a CVSS score of 9.3, which has been exploited and affects all NetScaler ADC and Gateway appliances. Citrix has patched this vulnerability as of August 19. AdaptHealth reported a data breach affecting over 4.1 million individuals, compromising personal, health, and insurance information, but not Social Security numbers or financial data. A new strain of Android malware, MantaxOtax, attributed to Indonesian threat actors, combines ransomware and spyware, stealing sensitive information and affecting older Android versions. The Gigabud banking trojan has evolved to evade detection by installing a secondary app that hides the malicious application. CISA acting director Nick Andersen emphasized the need for swift adaptation to cybersecurity threats and highlighted staffing improvements within CISA. Russian e-commerce giant Wildberries experienced disruptions from a DDoS attack affecting payments to sellers, following claims of a cyber operation by Ukraine's military intelligence. McKesson faced a cyberattack exposing sensitive data of 6.4 million individuals, with the ShinyHunters group releasing this data after a failed extortion attempt. IDScan confirmed a data breach affecting 150 million individuals, resulting in the theft of personally identifiable information and government-issued documents.

AppWizard

September 10, 2026

Google Play Early Access Abused to Push Thousands of Deceptive Android Apps

Bad actors are exploiting Google Play's Early Access program to distribute misleading applications that promise money, rewards, and casino winnings. This program allows developers to gather user feedback on unreleased apps but lacks public reviews or star ratings, enabling malicious actors to launch numerous fraudulent applications without immediate scrutiny. An example is the app "Vice Streets: Open World," which mimics Grand Theft Auto, has over 1 million downloads, and recently disappeared from the store without reviews or ratings. These deceptive apps are often promoted on social media with misleading advertisements and promise cash rewards, but users face obstacles when trying to withdraw their earnings. The primary goal of these apps is to generate revenue through excessive advertisements while circumventing regulatory requirements for legitimate gambling apps. Additionally, various malware families targeting Android devices have emerged, including Hagaseca, Mantax Otax, StreamRat, and GoldFactory's use of the Gigabud banking trojan, highlighting ongoing security threats in the digital landscape.

AppWizard

September 10, 2026

Gigabud Creates Android Work Profiles to Hide From Banking App Malware Checks

The Gigabud banking trojan installs a secondary Android application called Vwork, which creates a work profile on compromised devices to evade detection from banking app security measures. This work profile separates its contents from the personal space of the device, allowing fraudulent transactions without triggering alerts. Group-IB confirmed this operational chain in Indonesia, where Gigabud has been active since 2022 and is linked to the GoldFactory group, which uses deceptive tactics to distribute the trojan. Vwork simplifies the creation of a work profile and communicates with an external server for authorization before cloning apps. The report indicates that Vwork has been detected in various countries, while approximately 1,469 devices and 1,281 logins were compromised in Indonesia, leading to estimated losses of around ,000,000. Users can check for a work profile in their phone's settings and are advised to download apps only from official stores and to deny unnecessary Accessibility access.

AppWizard

September 9, 2026

Hackers Clone Banking Apps into Hidden Profiles, Android Malware Raises New Fraud Concerns

Cybercriminals are using advanced Android malware that mimics banking applications within hidden Work Profiles to bypass traditional fraud detection systems. This method is linked to Gigabud, a Remote Access Trojan active since at least 2022, and Vwork, an application cloning tool based on open-source software. Attackers distribute phishing links via social media and messaging, tricking victims into installing malicious files disguised as legitimate utilities. Once installed, the malware seeks Accessibility permissions and other capabilities to capture screen credentials and control the device. Vwork creates an isolated Work Profile to duplicate banking apps, allowing attackers to conduct fraudulent transactions without triggering security alerts in the personal space. Instances of counterfeit financial applications operating from these isolated environments have been documented, particularly in Indonesia. Between February and July 2026, monitoring revealed around 1,469 compromised devices and 1,281 compromised account credentials in Indonesia, resulting in estimated financial losses of 8.2 crore rupees. The operation is believed to be part of a larger international campaign linked to GoldFactory, with malware targeting users in multiple countries including Brazil, Colombia, Egypt, and others. Security experts warn that unusual Work Profile installations, duplicated banking apps, and unexpected requests for Accessibility permissions indicate a compromised device. Users are advised against sideloading APK files from private messages and should limit sensitive permissions to verified applications. Researchers emphasize the need for financial institutions to adopt behavioral analysis to detect unauthorized transactions effectively.

AppWizard

September 9, 2026

Gigabud Uses Android App Cloning to Evade Fraud Detection

The Gigabud Android banking trojan can clone banking applications into a separate Android work profile, allowing fraudsters to bypass malware alerts during transactions. Research by Group-IB, released on September 9, indicates that Gigabud is used with Vwork, a modified app for cloning, attributed to the GoldFactory group. The infection has been confirmed in Indonesia but targets 11 countries, including Brazil, Colombia, Egypt, Mexico, Thailand, and Turkiye. Vwork uses Android's Work Profile feature to isolate cloned apps, making them less detectable. This allows operators to install malware, clone banking apps, and execute transactions without raising alarms. During fraud, fake login screens capture credentials, and an invisible overlay collects lock screen codes. From February to July 2026, 1,469 devices were compromised in Indonesia, with financial losses nearing 0,939. Gigabud spreads through phishing and social media, requesting permissions to control devices. Group-IB identified six behavioral signals for banks to monitor as indicators of high-risk sessions. Recommendations include device binding and downloading apps only from official stores.

AppWizard

July 7, 2026

Why There’s A Briefcase Symbol On Your Android Phone’s Screen (And How To Turn It Off)

Android has introduced a feature called Work Profile that creates a dedicated workspace on devices, separating professional applications from personal ones. This allows users to maintain distinct versions of applications, such as having separate Gmail accounts for work and personal use. The data within the Work Profile is encrypted and accessible only to an organization's IT administrators, ensuring privacy for personal applications and data. Users can identify work apps by a briefcase icon in the status bar, which disappears when the app is closed. To temporarily pause the Work Profile, users can access the Quick Settings panel or navigate to the app drawer and select the Work tab. When paused, work apps will vanish from the app drawer, and notifications will cease. Users can reactivate the Work Profile through the same methods. Additionally, Android's Digital Wellbeing settings allow users to schedule the activation and deactivation of the Work Profile. To permanently disable the Work Profile, users must delete it from the device, which removes all associated work apps and data. This can only be done if the device was originally owned by the user or if ownership has been transferred. The steps include accessing the Settings app, selecting Passwords and accounts, navigating to the Work tab, and tapping on Remove work profile. A factory reset can also delete the Work Profile but will erase personal apps and data as well.

AppWizard

June 19, 2026

Android 17 is making Pixel widgets vanish, but Google already has a fix in the works

Users of Android 17 have reported that home screen widgets are disappearing after the latest stable update, specifically on devices with a work profile. Google is aware of the issue and is working on a fix, which may be included in the next month's security update. Currently, there is no effective workaround other than removing the work profile, which allows users to restore their widgets by restarting the device and re-adding them.