The Unkillable Spy: How “Operation NoVoice” Rootkits Hijack Androids and Clone WhatsApp

McAfee researchers uncovered "Operation NoVoice," a sophisticated Android rootkit campaign distributed through seemingly legitimate Google Play apps that profile devices, download tailored root exploits, and achieve persistent, system-level control (surviving factory resets). The malware injects into every app launch—targeting WhatsApp to clone sessions—and is backed by active C2 infrastructure; devices with security patches older than May 2021 are especially at risk.