{"id":228046,"date":"2026-03-31T03:00:46","date_gmt":"2026-03-31T10:00:46","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=228046"},"modified":"2026-03-30T12:20:14","modified_gmt":"2026-03-30T19:20:14","slug":"operation-novoice-android-malware-mcafee-research","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/operation-novoice-android-malware-mcafee-research\/","title":{"rendered":"Operation NoVoice: Android Malware Found in 50+ Apps Can Hijack Devices"},"content":{"rendered":"

McAfee\u2019s mobile research team has uncovered a large-scale Android malware campaign\u00a0we\u2019re\u00a0tracking as\u00a0Operation\u00a0NoVoice.<\/p>\n

The campaign was distributed through more than\u00a050 apps previously available on Google Play, disguised as everyday tools like cleaners, games, and photo utilities. Together, the apps were downloaded more than\u00a02.3 million times, though it\u2019s unclear how many devices may have been impacted.<\/p>\n

If the attack succeeds, the malware can gain\u00a0deep control of a device, allowing attackers to inject malicious code into apps as they are opened and access sensitive data.<\/p>\n

However, the most serious impact depends on the device.<\/span>\u00a0<\/span><\/p>\n

On\u00a0older or unpatched Android devices, the malware can install a highly persistent form of infection that may survive a standard factory reset. Newer Android devices with up-to-date security protections are\u00a0not vulnerable to the root exploit observed in this campaign, though they may still be exposed to other types of malicious activity from these apps.<\/p>\n

In other words, on vulnerable devices, the malware can behave like a kind of\u00a0digital \u201czombie,\u201d\u00a0continuing to\u00a0operate\u00a0in the background even after a reset.<\/p>\n

Want the full technical breakdown?\u00a0<\/span>Dive into the McAfee Labs research here.<\/span><\/a>\u00a0<\/span><\/p>\n

We break down what you need to know below:<\/span>\u00a0<\/span><\/p>\n

How\u00a0“Operation\u00a0NoVoice” Works<\/span>\u00a0<\/span><\/h2>\n

Operation\u00a0NoVoice\u00a0is what security experts call a\u00a0<\/span>rootkit malware attack<\/span><\/b>.<\/span>\u00a0<\/span><\/p>\n

A\u00a0<\/span>rootkit<\/span><\/b>\u00a0is a type of malware designed to gain deep, privileged control of a device while hiding its presence from the user and the operating system\u2019s normal security tools.<\/span>\u00a0<\/span><\/p>\n

Breaking the term down:<\/span>\u00a0<\/span><\/p>\n