A concerning new malware named "NoVoice" has been identified in over 50 applications on the Google Play Store, potentially affecting 2.3 million users. This discovery, highlighted in a report by "Bleeping Computer," reveals that the malware poses a significant threat, lurking within seemingly benign apps such as system cleaners and games. Cybersecurity experts from McAfee were the first to uncover this malicious payload, raising alarms about the risks associated with our mobile apps.
How Malware Hides in Plain Sight
Malicious software often disguises itself within applications that appear harmless, tricking users into downloading them. Upon installation, the NoVoice malware exploits vulnerabilities within Android devices, aiming for root access. This access could enable attackers to gather sensitive information, including usernames and passwords for financial applications, and manipulate app installations on the infected device without the user’s consent.
In a worrying twist, portions of the NoVoice malware are designed to remain even after a factory reset, making it particularly resilient. Fortunately, there’s some good news: devices running Android versions updated since May 2021 are safeguarded against this threat. Devices like the Pixel 6 Pro, launched in October 2021, have received updates that provide protection.
Tracing the Malware Origins
Research by McAfee indicates that the malware was less effective in regions such as Beijing and Shenzhen in China, giving insight into the potential origins of the attack. This may indicate a deliberate effort by the perpetrators to avoid detection by local law enforcement.
Google Play Store listing of an app infected with NoVoice. | Image by Bleeping Computer
In response to the threat, Google has activated Google Play Protect to automatically remove the harmful apps and prevent new installations. They also emphasize the importance of installing the latest security updates for Android devices.
Despite these measures, the specific apps implicated in this malware attack have not been disclosed. However, an example highlighted is an app named SwiftClean, developed by Biodun Popoola, which was found to harbor the NoVoice payload. The malware derives its name from a silent audio file embedded within its code that operates at a non-detectable volume, enabling the harmful code to run unnoticed. To protect against such threats, users are advised to only install apps from the Google Play Store and remain vigilant with their device updates.
