A new dangerous malware attack called “NoVoice” has been discovered and was mentioned in a new report in “Bleeping Computer.” The malware was found as payload in more than 50 apps listed in the Google Play Store. The report says that these apps were installed a total of 2.3 million times from Google’s Android app storefront. Employees at cybersecurity researcher McAfee discovered “NoVoice” and found it inside various apps such as system cleaners, games, and image galleries.
The most innocent apps contain the most dangerous payloads
That’s how attackers get you. Hiding malware inside what appears to be an innocent and useful app leads Android users to install the app. Once installed, the malware delivered as the payload exploits any Android vulnerabilities in an attempt to get root access. Not only will this lead the attackers to pick up information including usernames and passwords for your financial services apps, the malware can help install and delete apps onto your phone without your knowledge.
How you can tell which country the attackers are from
McAfee found that in certain regions, such as Beijing and Shenzhen in China, the malware failed to infect devices. This certainly gives you an idea about which country the attack was developed in. It allows the perpetrators to stay clear of domestic law enforcement.
In a statement, Google said that Google Play Protect automatically removed the malicious apps and blocked new installations. Google also said that Android users should always download the latest security update released for their devices.
As an added layer of defense, Google Play Protect automatically removes these apps and blocks new iinstallations. Users should always install the latest security updates available for their device.
Unfortunately, Bleeping Computer didn’t name the more than 50 apps involved. It did include an image of the Play Store listing of an app called SwiftClean, which it says carried the NoVoice payload. The developer was Biodun Popoola. The malware gets its name from a silent audio file found in the code that plays at no volume in order to have the malicious code run in the background without getting detected by the user. To avoid malware like this, only install Android apps from the Google Play Store and also make sure to always update your phone.
