Cybersecurity — 2026-04-15
NoVoice Android Rootkit Infects 2.3 Million Devices via Google Play, Survives Factory Resets
McAfee researchers discovered the NoVoice Android malware distributed through 50+ apps on Google Play with at least 2.3 million downloads. The
Analysis
The campaign's evasion architecture, combining genuine app functionality, no suspicious permissions, and deliberate reliance on vulnerabilities patched before 2022, reflects substantial investment in bypassing Play Store review while avoiding modern behavioral detections, per McAfee's sole technical account. System partition payloads survive factory resets, and affected users on pre-May 2021 Android security patches will likely require device replacement within the next several weeks. Triada-family similarities point to a sophisticated, financially motivated actor with prior mobile supply chain experience; the exclusive use of pre-2021 CVEs may instead mark a geographically constrained operation targeting markets with slow device update cycles rather than a global campaign.
The campaign's evasion architecture, combining genuine app functionality, no suspicious permissions, and deliberate reliance on vulnerabilities patched before 2022, reflects substantial investment in bypassing Play Store review while avoiding modern behavioral detections, per McAfee's sole technical account. System partition payloads survive factory resets, and affected users on pre-May 2021 Android security patches will likely require device replacement within the next several weeks. Triada-family similarities point to a sophisticated, financially motivated actor with prior mobile supply chain experience; the exclusive use of pre-2021 CVEs may instead mark a geographically constrained operation targeting markets with slow device update cycles rather than a global campaign.