NoVoice on Google Play with 22 Exploits Attacks Millions of Android Users

**Operation NoVoice**: a stealthy Android rootkit campaign discovered in over 50 Google Play apps (2.3M+ downloads) that uses 22 device-specific exploits to gain persistent root, replaces libandroid_runtime.so to run attacker code for all apps, disables SELinux, survives factory resets, and has been observed delivering a WhatsApp session-cloning payload; mitigation includes updating devices to the May 1, 2021 security patch or newer and blocking known C2 domains.