'NoVoice' Android malware on Google Play infected 2.3 million devices
NoVoice Android malware hidden in 50+ Google Play apps infected 2.3M devices.
McAfee discovered NoVoice, an Android malware distributed through over 50 apps on Google Play that were downloaded at least 2.3 million times. The malware exploits outdated Android vulnerabilities (patched 2016–2021) to gain root access, establishes persistence across factory resets, and primarily targets WhatsApp data theft by intercepting encryption keys and session data. Infected apps have been removed from Google Play, but users are advised to consider their devices compromised and upgrade to devices with current security patches.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonThe NoVoice malware incident demonstrates critical failures in both app store supply chain security and device patch management. Over 50 malicious apps bypassed Google Play's security screening and infected 2.3 million devices by exploiting Android vulnerabilities that were patched years ago (2016-2021). The malware's ability to survive factory resets and steal WhatsApp encryption keys shows how outdated devices become permanent security risks. This highlights why organizations must treat mobile app distribution as a supply chain risk and maintain current security patches on all devices.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — NoVoice
- malware — Triada
- mitre_attack — T1401
- mitre_attack — T1547.014
- mitre_attack — T1005