[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f92lfxHBlliwvk0ITnjvxPn369uoJfvYu28aUyf6vOd4":3},{"article":4,"iocs":34,"watch_terms":51,"solutions":52,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"9e12e0c7-a847-4bc9-838e-e16082d5bb0c","'NoVoice' Android malware on Google Play infected 2.3 million devices","novoice-android-malware-on-google-play-infected-2-3-million-devices","A new Android malware named NoVoice was found on Google Play, hidden in more than 50 apps that were downloaded at least 2.3 million times. [...]","McAfee discovered NoVoice, an Android malware distributed through over 50 apps on Google Play that were downloaded at least 2.3 million times. The malware exploits outdated Android vulnerabilities (patched 2016–2021) to gain root access, establishes persistence across factory resets, and primarily targets WhatsApp data theft by intercepting encryption keys and session data. Infected apps have been removed from Google Play, but users are advised to consider their devices compromised and upgrade to devices with current security patches.","NoVoice Android malware hidden in 50+ Google Play apps infected 2.3M devices.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnovoice-android-malware-on-google-play-infected-23-million-devices\u002F",null,"2026-04-01T18:07:21+00:00","2026-04-01T20:00:12.890023+00:00",9,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":12,"name":19,"slug":20},"Malware","malware",[22,27,29],{"category":23},{"id":24,"icon":12,"name":25,"slug":26},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":28},{"id":17,"icon":12,"name":19,"slug":20},{"category":30},{"id":31,"icon":12,"name":32,"slug":33},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[35,38,41,45,48],{"type":20,"value":36,"context":37},"NoVoice","Android malware distributed via Google Play, roots devices and steals WhatsApp data",{"type":20,"value":39,"context":40},"Triada","Android trojan with similar characteristics to NoVoice",{"type":42,"value":43,"context":44},"mitre_attack","T1401","Exploitation of software vulnerabilities for privilege escalation",{"type":42,"value":46,"context":47},"T1547.014","Persistence via modification of system binaries and rootkit installation",{"type":42,"value":49,"context":50},"T1005","Collection of sensitive data from device applications (WhatsApp)",[],{"controls":53,"vendors":129},[54,83,108],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,92,100],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":84,"product_name":89,"url":90,"description":91},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":109,"name":110,"problem":111,"products":112},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[113,121],{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[130],{"slug":131,"name":132,"logo_path":133,"roles":134},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[135],"affected",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":146},"android-malware-infects-23m-devices-through-app-store-supply-chain","Android Malware Infects 2.3M Devices Through App Store Supply Chain","The NoVoice malware incident demonstrates critical failures in both app store supply chain security and device patch management. Over 50 malicious apps bypassed Google Play's security screening and infected 2.3 million devices by exploiting Android vulnerabilities that were patched years ago (2016-2021). The malware's ability to survive factory resets and steal WhatsApp encryption keys shows how outdated devices become permanent security risks. This highlights why organizations must treat mobile app distribution as a supply chain risk and maintain current security patches on all devices.",[141,142,143,144,145],"CIS Control 2.1","CIS Control 7.1","NIST SP 800-124","NIST CM-11","NIST SI-7",{}]