The g21news hijack was triggered by the "TopicNews" app. Before the recent security update, that apk was called "Topic" app, I had it disabled and uninstalled via ADB shell commands. Back at that time, the hijacked sites and pops were various game sites. The phone system snapshot I took shows the update somehow changed the apk name and re-install re-enable it.