Back Gbhackers

NoVoice on Google Play Exploits 22 Flaws to Hit Millions of Android Users

Gbhackers •Mayura Kathir • April 2, 2026

NoVoice is a new Android rootkit campaign that hid in more than 50 apps on Google Play, exploiting 22 vulnerabilities to hijack millions of older and unpatched Android devices and even clone WhatsApp sessions. The apps posed as everyday utilities such as cleaners, casual games, and gallery tools, and behaved normally to avoid raising suspicion. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NoVoice Android Malware Infects 2.3 Million Devices via Google Play Apps The NoVoice Android malware has been discovered on Google Play, hidden in over 50 apps that have been downloaded more than 2.3 million times. This malware, identified by McAfee, exploits 22 vulnerabilities in older Android versions to gain root access and compromise devices. The infected apps, which include cleaners and games, required minimal permissions and functioned normally to avoid detection. Once activated, NoVoice attempts to gain root access by exploiting vulnerabilities patched between 2016 and 2021. It employs steganography to conceal malicious payloads within PNG files and uses various checks to avoid detection by emulators and VPNs. After compromising a device, the malware can inject code into all launched applications, primarily targeting WhatsApp to exfiltrate session data. The malware's persistence mechanisms allow it to survive factory resets, posing a significant risk to users. Google has removed the malicious apps, but users who downloaded them are advised to consider their devices compromised. 6 sources 73

Extracted Entities

NoVoice on Google Play Exploits 22 Flaws to Hit Millions of Android Users

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (2)