A new Android threat called NoVoice was discovered on the Google Play store. It was hidden in over 50 apps, resulting in at least 2.3 million downloads.

The infected apps included tools like cleaners and image viewers, as well as games. These apps didn’t ask for odd permissions and functioned as advertised.

Once an infected app was opened, the malware attempted to gain root access by taking advantage of older Android security weaknesses that were fixed between 2016 and 2021.

Cybersecurity experts at McAfee uncovered the NoVoice campaign but couldn’t attribute it to a specific attacker. However, they pointed out that the malware shared characteristics with the Triada Android trojan.

According to McAfee’s findings, the perpetrator hid harmful components within the com.facebook.utils package, blending them with genuine Facebook SDK code.

An encrypted file (enc.apk), concealed in a PNG image using steganography, is extracted (h.apk) and loaded into the device’s memory, while all temporary files are deleted to hide its presence.

McAfee also discovered that the malware avoids infecting devices in certain regions, like Beijing and Shenzhen in China. It also includes 15 checks for emulators, debuggers, and VPNs. If location access is unavailable, the infection continues.

The malware then reaches out to its control server to collect device information like hardware specs, kernel and Android versions (including patch level), the list of installed apps, and root status. This helps it decide on the best rooting method.

Next, the malware communicates with the control server every minute and downloads different components, each designed to root the device using tailored exploits.

The researchers mapped out the entire infection process, from initial delivery to the final code injection.

McAfee reports finding 22 exploits, including kernel vulnerabilities and issues with Mali GPU drivers. These exploits allow the attackers to gain root access and disable SELinux, a key security feature, leaving the device unprotected.

After rooting the device, important system files are altered, like libandroid_runtime.so and libmedia_jni.so, replacing them with malicious versions that intercept system calls and redirect them to the attacker’s code.

The rootkit ensures it remains persistent by installing recovery scripts, replacing the default crash handler with a rootkit loader, and storing backup files on the system partition.

Because this part of the storage isn’t wiped during a factory reset, the malware stays even after a complete system wipe.

A monitoring program runs every minute , checking for the rootkit’s integrity and reinstalling any missing parts. If problems are found, it forces a device restart to reload the rootkit.

Once it has control, the malware injects code into every app that is launched. It deploys two key components: one to silently install or uninstall apps and another that runs within any app that connects to the internet.

The latter component acts as the primary method for stealing data, and McAfee observed that it specifically targeted the WhatsApp application.

When WhatsApp launches on a compromised device, the malware grabs key security information used to duplicate the victim’s WhatsApp session, including encryption keys, the Signal protocol keys, and account details like the phone number and Google Drive backup information.

This information is sent to the attacker’s server, enabling them to clone the victim’s WhatsApp on their own device.

The researchers highlighted that, although they only found code focused on WhatsApp, NoVoice is designed in a way that allows it to target any app on the device.

The harmful apps carrying the NoVoice malware were removed from Google Play after McAfee, which is part of the App Defense Alliance, notified Google.

However, users who previously installed these apps should consider their devices and data to be at risk.

Because NoVoice uses vulnerabilities that were patched up to May 2021, updating to a device with a more recent security update will block this threat in its current form.

It’s advised that Android users update to actively supported devices and only download apps from trusted sources, even if they are on the Google Play Store.