NoVoice on Google Play Exploits 22 Flaws to Hit Millions of Android Users
ID: 44415da5-6e0a-543b-9cf2-638577056553
STIX ID: report--44415da5-6e0a-543b-9cf2-638577056553
Feed Name: GBHackers
Threat Score
NoVoice is a large-scale Android rootkit campaign distributed through over 50 trojanized apps on Google Play (≥2.3M downloads) that leverages 22 vulnerabilities (2016–2021) to gain root on unpatched devices, install a persistent system-level rootkit (CsKaitno.d) by replacing critical libraries, and exfiltrate sensitive data — notably WhatsApp keys to clone sessions — via a segmented C2/plugin infrastructure; McAfee disclosed the campaign and Google removed the apps.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.