{"id":227149,"date":"2026-03-31T02:30:23","date_gmt":"2026-03-31T09:30:23","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=227149"},"modified":"2026-03-30T12:21:14","modified_gmt":"2026-03-30T19:21:14","slug":"new-research-operation-novoice-rootkit-malware-android","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/new-research-operation-novoice-rootkit-malware-android\/","title":{"rendered":"Operation NoVoice: Rootkit Tells No Tales"},"content":{"rendered":"

Authored By: Ahmad Zubair Zahid<\/span><\/span>\u00a0<\/span><\/em><\/p>\n

McAfee\u2019s mobile research team\u00a0identified\u00a0and investigated an Android rootkit campaign tracked as Operation\u00a0Novoice. The malware described in this blog relies on vulnerabilities Android made patches available for in 2016 \u2013 2021. All Android devices with a security patch level of 2021-05-01 or higher are not susceptible to the exploits that we were able to obtain from the command-and-control server.\u00a0However\u00a0patched devices that downloaded these apps could have been exposed to unknown potential payloads outside of what we discovered. The attack begins with apps that were previously available on Google Play that\u00a0appear to be\u00a0simple tools such as cleaners, games, or gallery utilities. When a user downloaded and opened one of these apps, it appeared\u00a0to behave\u00a0as advertised, giving no obvious signs of malicious activity.\u00a0<\/span>\u00a0<\/span><\/p>\n

In the background, however, the app contacts a remote server, profiles the device, and\u00a0downloads root\u00a0exploits tailored to that device\u2019s specific hardware and software. If the exploits\u00a0succeed, the malware gains full control of the device. From that moment onward, every app that the user opens\u00a0are\u00a0injected with attacker\u2011controlled code.\u00a0<\/span>\u00a0<\/span><\/p>\n

This allows the operators to access any\u00a0app\u00a0data and exfiltrate it to their servers. One of the targeted apps is WhatsApp. We\u00a0recovered a payload designed to execute when WhatsApp launches, gather all necessary data to clone the session, and send it to the attacker\u2019s infrastructure.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

On older, unsupported devices (Android 7 and lower) that no longer receive Android security updates as of September\u00a02021, this\u00a0rootkit is highly persistent; a standard factory reset will not remove it, and only\u00a0reflashing\u00a0the device with a clean firmware will fully restore the device.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n

In total, we\u00a0identified\u00a0more than 50 of these malicious apps on Google Play, with at least 2.3 million downloads.\u00a0<\/span>\u00a0<\/span><\/p>\n

McAfee\u00a0identified\u00a0the malicious apps, conducted the technical analysis, and reported its findings to Google through responsible disclosure channels. Following McAfee\u2019s report, Google removed the identified apps from Google Play and banned the associated developer accounts. McAfee is a member of the App Defense Alliance, which supports collaboration across the mobile ecosystem to improve user protection. McAfee\u00a0Mobile Security detects this malware as a\u00a0High-Risk\u00a0Threat. For more information, and to get fully protected, visit\u00a0<\/span><\/i>McAfee Mobile Security<\/span><\/i><\/a>.\u00a0<\/span><\/i>\u00a0<\/span><\/p>\n

Background<\/span> And Key Findings<\/span><\/h2>\n

Android malware has been moving toward modular frameworks that update themselves remotely and adapt to each device. Campaigns like\u00a0<\/span>Triada\u00a0<\/span><\/a>and\u00a0<\/span>Keenadu\u00a0<\/span><\/a>have shown that replacing system libraries gives attackers persistence to survive factory resets.\u00a0<\/span>BADBOX\u00a0<\/span><\/a>has shown that backdoors pre-installed through the supply chain can reach millions of devices. Recent research has confirmed links between several of these families, suggesting shared tooling rather than isolated efforts.<\/span>\u00a0<\/span><\/p>\n

NoVoice\u00a0fits both trends but does not rely on supply chain access. It reaches devices through Google Play and achieves the same level of persistence through exploitation.\u00a0McAfee\u2019s investigation revealed the following key findings:<\/span>\u00a0<\/span><\/p>\n