NoVoice Malware Found in 50+ Google Play Apps With 2.3 Million Installs
Summary
McAfee detailed NoVoice, found in 50+ Google Play apps with at least 2.3 million installs. It uses exploits to root Android devices, persist through factory resets, and steal WhatsApp session data; the apps have been removed.
Key points
- More than 50 Google Play apps, including cleaners, galleries, and games, carried NoVoice and had at least 2.3 million installs.
- NoVoice hides components in the com.facebook.utils package and extracts an encrypted payload concealed in a PNG using steganography.
- McAfee observed the malware using up to 22 exploits, including kernel and Mali GPU driver flaws, to gain root access and disable SELinux.
- The rootkit uses recovery scripts, a replaced crash handler, system-partition payloads, and a watchdog to maintain persistence, including after factory resets.
- McAfee observed injected code stealing WhatsApp session data, including encryption databases, Signal protocol keys, account identifiers, and Google Drive backup details, for account cloning.
- Google removed the reported apps. The article says upgrading to a device with a security patch later than May 2021 mitigates the threat in its current form.
Article Details
- Attack Vectors
- NoVoice was distributed in more than 50 Google Play apps, including cleaners, galleries, and games; the apps had at least 2.3 million installs.
- The malware concealed components in the com.facebook.utils package and extracted an encrypted payload from a PNG using steganography.
- NoVoice attempted to root infected devices by exploiting Android vulnerabilities patched between 2016 and 2021, then modified system libraries and installed persistent rootkit components.
- Post-exploitation code was injected into apps. McAfee observed theft of WhatsApp encryption databases, Signal keys, account identifiers, and Google Drive backup details, followed by exfiltration to the C2.
- Defensive Notes
- The malicious apps were removed from Google Play after McAfee reported them to Google; the article says users who previously installed them should consider their devices and data compromised.
- The article says upgrading to a device with a security patch later than May 2021 mitigates NoVoice in its current form.
- Android users are advised to upgrade to actively supported devices and install apps only from trusted, well-known publishers, including when using Google Play.
MITRE ATT&CK
T1005 · Data from Local SystemThe malware extracted WhatsApp encryption databases, Signal keys, and account-related information from the infected device.T1014 · RootkitAfter rooting devices, NoVoice replaced system libraries with hooked wrappers and installed persistent rootkit components.T1041 · Exfiltration Over C2 ChannelMcAfee observed the stolen WhatsApp-related data being exfiltrated to the C2.T1055 · Process InjectionPost-exploitation code was injected into apps launched on the infected device.T1068 · Exploitation for Privilege EscalationNoVoice attempted to exploit old Android vulnerabilities to obtain root access.T1070.004 · File DeletionNoVoice wiped intermediate files after extracting and loading its payload to eliminate traces.T1105 · Ingress Tool TransferThe malware polled its C2 and downloaded components for device-specific exploits.T1406NoVoice used steganography to conceal an encrypted payload inside a PNG image.T1622 · Debugger EvasionNoVoice performed checks for debuggers as part of its device validation.T1627.001The malware avoided infection in specified regions, including Beijing and Shenzhen.T1633NoVoice performed checks for emulators as part of its device validation.
Malware
NoVoiceNoVoice is a new Android threat found in over 50 Google Play apps with at least 2.3 million installs that uses steganography and a suite of exploits to obtain root and install a persistent rootkit.TriadaHowever, they highlighted that the malware shared similarities with the Triada Android trojan.
Vendors
Products
AndroidNoVoice is a new Android threat found in over 50 Google Play apps with at least 2.3 million installs that uses steganography and a suite of exploits to obtain root and install a persistent rootkit.Google PlayNoVoice is a new Android threat found in over 50 Google Play apps with at least 2.3 million installs that uses steganography and a suite of exploits to obtain root and install a persistent rootkit.SignalPost-exploitation code injects into any app with internet access to exfiltrate data—McAfee observed WhatsApp session data, Signal keys, and backup info being stolen to enable account cloning.WhatsAppIt injects into apps to steal sensitive data—most notably WhatsApp encryption keys and backups—allowing attackers to clone accounts;