A large-scale Android malware campaign, designated ‘NoVoice,’ distributed rootkit-capable malware through more than 50 trojanized applications on Google Play, accumulating approximately 2.3 million installs before removal. The rootkit achieves kernel-level persistence and targets WhatsApp by extracting session keys, enabling attackers to clone messaging sessions on attacker-controlled infrastructure, giving adversaries full access to encrypted communications without requiring the device itself. Organizations whose employees use Android devices for business communications, including WhatsApp for operational or executive messaging, face a credible risk of session compromise and data exfiltration that cannot be remediated through standard app removal on older unpatched devices. NOTE: This campaign is sourced from secondary outlets with a source quality score of 0.56; CVE identifiers, full attribution, and the 2.3 million install figure require verification against primary sources before use in board-level reporting.