Back Cybersecuritynews

NoVoice on Google Play with 22 Exploits Attacks Millions of Android Users

Cybersecuritynews •Tushar Subhra Dutta • April 2, 2026

A dangerous Android rootkit named NoVoice has been hiding inside over 50 apps on Google Play, compromising more than 2.3 million devices worldwide. Tracked as Operation NoVoice, the malware uses 22 exploits to take full control of a device without raising any alerts, making it one of the most destructive Android threats uncovered in recent […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NoVoice Android Malware Infects 2.3 Million Devices via Google Play Apps The NoVoice Android malware has been discovered on Google Play, hidden in over 50 apps that have been downloaded more than 2.3 million times. This malware, identified by McAfee, exploits 22 vulnerabilities in older Android versions to gain root access and compromise devices. The infected apps, which include cleaners and games, required minimal permissions and functioned normally to avoid detection. Once activated, NoVoice attempts to gain root access by exploiting vulnerabilities patched between 2016 and 2021. It employs steganography to conceal malicious payloads within PNG files and uses various checks to avoid detection by emulators and VPNs. After compromising a device, the malware can inject code into all launched applications, primarily targeting WhatsApp to exfiltrate session data. The malware's persistence mechanisms allow it to survive factory resets, posing a significant risk to users. Google has removed the malicious apps, but users who downloaded them are advised to consider their devices compromised. 6 sources 73

Extracted Entities

NoVoice on Google Play with 22 Exploits Attacks Millions of Android Users

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (1)

Platforms (1)