App cloning is the duplication of an app into another container, profile, or managed workspace so it runs as a separate instance. On Android, this can happen inside a Work Profile or similar isolation layer, where the cloned app has its own data, settings, and login state. The technique is useful for legitimate separation of personal and business apps, but it also changes how security teams must observe a device.
In attacks, app cloning can be abused to hide fraudulent activity or to break the link between malicious behavior in one profile and visible actions in another. For example, a financial app copied into a managed space may generate activity that single-profile monitoring misses. Defenders look for unexpected profile creation, duplicate app instances, unusual device-management changes, and security tools that can correlate events across profiles. App cloning matters because it can turn platform isolation into cover for abuse.