NoVoice Android rootkit hid in 50+ Google Play apps with 2.3 million downloads

McAfee Labs found NoVoice, an Android rootkit hidden in more than 50 Google Play apps with at least 2.3 million combined downloads. The apps asked for no unusual permissions. They used old kernel and GPU-driver exploits to get root on devices that had stopped receiving security updates, then replaced system libraries so the infection survived a factory reset. For mobile developers and anyone managing Android fleets, it's a clear example of why patch level matters more than permission prompts.

What happened

McAfee published "Operation NoVoice: Rootkit Tells No Tales" on 31 March 2026. The malicious apps looked like cleaners, galleries and casual games, and they worked as advertised. After McAfee reported them, Google removed the apps and banned the developer accounts.

The infection chain:

1. The app checks the device (most samples target Android 12L or lower) and downloads exploits from command-and-control servers. McAfee recovered 22 exploits.
2. One chain McAfee described uses an IPv6 use-after-free to read kernel memory and a Mali GPU driver flaw to gain kernel read/write. It then patches process credentials and disables SELinux to get a root shell.
3. The rootkit replaces libandroid_runtime.so and libmedia_jni.so on the system partition and patches framework bytecode on disk. A watchdog checks the installation every 60 seconds and reinstalls anything that has been removed.
4. The only payload McAfee recovered targets WhatsApp. It steals Signal-protocol keys, registration data and account details so the attacker can clone the victim's session. The framework can load other payloads too.

McAfee found the highest infection rates in Nigeria, Ethiopia, Algeria, India and Kenya, which it links to budget phones running old Android builds. It notes code similarities to the Triada family but doesn't confirm a direct link.

Who is affected

• Devices with a security patch level before 2021-05-01. McAfee says devices patched on or after that date aren't vulnerable to the exploits it recovered, although installing the apps could still have exposed them to other payloads.
• Devices on Android 7 or earlier no longer get security updates, and McAfee describes infections on them as highly persistent.
• WhatsApp users on infected devices, whose accounts could be cloned.
• Organisations with BYOD or low-cost Android fleets, for example field staff or point-of-sale devices.

What it means for developers and engineering teams

NoVoice shows that Android's permission model doesn't protect you once the kernel can be exploited. The apps didn't need risky permissions because root access made permissions irrelevant. Replacing libandroid_runtime.so means code inside every app process can be hooked, including your banking or messaging app. Because the change lives on /system, a factory reset, which wipes only /data, doesn't remove it. McAfee says only a clean firmware reflash does.

If you build apps that handle sensitive sessions, you can't assume the operating system is trustworthy. Server-side signals matter more than client-side checks here. The Play Integrity API's device and strong integrity verdicts, checked on your backend, are designed to flag modified system images. Session keys bound to hardware-backed Keystore make cloning harder.

It also shows a gap in app-store review. Each app behaved normally and fetched its exploits from command-and-control servers only after it was installed and had checked the device. Static review of the submitted APK would find little. For teams that distribute internal apps or rely on third-party SDKs, any component that downloads and runs code at runtime should get extra scrutiny.

What to do now

• For fleets, use MDM to enforce a minimum security patch level (2021-05-01 at the very least, and realistically something recent) and block devices on Android 7 or earlier.
• For apps, verify Play Integrity verdicts on the server, and degrade or step up authentication when MEETS_DEVICE_INTEGRITY is missing.
• Store session and signing keys in hardware-backed Keystore with setIsStrongBoxBacked(true) where available, so a rooted device can't easily export them.
• If a device may be infected, reflash stock firmware. A factory reset isn't enough. Then re-register WhatsApp and check Linked Devices.
• Block the C2 domains in McAfee's IoC list at your DNS resolver or secure web gateway.
• Check unknown APKs before deploying them internally, for example with a static APK inspector.

Related on TechLogHub

• APK Analyzer: inspect Android packages in your browser
• Expo: cross-platform mobile app tooling

Sources

• McAfee Labs: Operation NoVoice: Rootkit Tells No Tales (31 March 2026)
• BleepingComputer: NoVoice Android malware on Google Play
• CyberInsider: Android rootkit NoVoice