A new Android malware from Google

What happened with the new Android malware from Google?

McAfee researchers found malware called NoVoice hidden inside more than 50 apps on Google Play, including cleaner tools, image galleries and games. It was downloaded at least 2.3 million times before Google removed it, reported on 1 April 2026.

NoVoice does not rely on tricking you into typing a password. It exploits known Android kernel and Mali GPU driver flaws, patched by Google between 2016 and 2021, to gain root access, disable built in security protections, and install a rootkit that survives a factory reset.

The specific target is messaging. NoVoice extracts WhatsApp and Signal encryption databases and session keys, which lets an attacker clone your messaging account onto their own device. That means someone else could read your chats or message your customers and suppliers pretending to be you.

Is my phone actually at risk?

Only if it has not received a security update since May 2021. Google has confirmed that devices updated since then are protected, and Google Play Protect now blocks the malicious apps from reinstalling.

The wider problem is scale. Google reported in February 2026 that over 40% of Android phones in use, more than one billion devices, no longer receive security updates because they still run Android 12 or older. If you or a member of staff has an older phone that "still works fine," it is likely in that group.

Why does this matter for a small business specifically?

Because most small business owners run their entire customer relationship through their phone: WhatsApp for bookings and enquiries, Google Business Profile logins, banking apps, and Instagram or Facebook access. A cloned WhatsApp account is not just personal, it is your booking diary and your reputation.

The UK Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses, roughly 612,000, suffered a breach or attack in the past year, and 38% of those involved phishing. Among businesses that were breached, the share reporting a direct loss of revenue or share value doubled year on year, from 2% to 5%. Only 47% of businesses have proper multi factor authentication in place, which is one of the simplest defences available.

What should I actually do this week?

Check your phone's Android version and update it immediately if it is Android 12 or older, since this is the single factor separating protected devices from exposed ones.

• Go to Settings, About Phone, and check for a pending security update on every work phone in the business, not just your own.
• Remove any cleaner, gallery booster or "free game" apps you do not clearly recognise and did not deliberately install.
• Turn on multi factor authentication for WhatsApp, your Google account and your Google Business Profile, since a rootkit still needs a second barrier to defeat.
• If a phone cannot be updated because it is too old, treat it as retired for business use. A £10 monthly phone plan is cheaper than a cloned WhatsApp account contacting your customers.

What is Braynex Services' take on this?

This story is really about a pattern we see constantly: small businesses build their entire customer relationship on top of platforms and devices they do not fully control, then discover the risk only when something breaks. A rented WhatsApp number on an unpatched phone is no different in principle to a rented Facebook page or a Fresha booking system. You are trusting someone else's infrastructure with your customer relationships.

Our view is not that WhatsApp is unsafe to use. It is that any single channel, whether that is a messaging app, a booking platform or a directory listing, should never be the only way customers can reach you or the only place your customer data lives. Businesses that also own a proper website, their own booking system and their own customer records have somewhere to fall back to if one channel is compromised or disappears. The businesses we have helped, like a Leeds salon that now gets 40 or more monthly calls from a properly verified Google Business Profile, are resilient precisely because they do not depend on one rented platform for everything.

If you are not sure whether your business phones, booking system or Google presence are properly protected and backed up, Braynex Services offers a free audit. Book yours at braynexservices.com.