Ankura CTIX FLASH Update – April 3, 2026

Malware Activity

How Attackers Are Weaponizing App Stores and Messaging Apps
Recent investigations highlight a troubling trend in which attackers are abusing trusted platforms to quietly compromise both mobile and desktop devices at scale. On Android, a sophisticated malware known as NoVoice was distributed through the official Google Play Store, hidden inside legitimate‑looking apps that infected over 2.3 million devices before being removed. These apps worked as advertised and raised no immediate red flags yet exploited outdated Android security flaws to gain deep system access and embed themselves so thoroughly that even factory resets may not fully remove them. At the same time, Microsoft has warned of a parallel campaign targeting Windows users via WhatsApp, where attackers deliver malicious script files through social engineering. Once opened, these files abuse built‑in Windows tools and trusted cloud services to bypass security controls, escalate privileges, and establish