Loading story…
ESET reported a new Android malware family, PromptSpy, assessed as the first known Android malware to incorporate generative AI directly into its execution flow to improve reliability of on-device actions. PromptSpy uses predefined prompts to Google’s Gemini to interpret the device UI and guide gestures that keep the malicious app “locked”/pinned in the recent apps view (often shown as a padlock icon), making it harder for users or the OS to dismiss and aiding persistence. Reported capabilities include collecting device information, taking screenshots, recording screen activity, capturing lockscreen data, and interfering with uninstallation attempts; ESET noted it has not been observed in their telemetry and may currently be a proof of concept, with indicators suggesting a financially motivated campaign primarily affecting users in Argentina.
Technical reporting described PromptSpy sending Gemini an XML dump of the current screen and receiving JSON instructions indicating what action to take and where, iterating until the app is successfully pinned—an approach that can be more adaptable across device models, launchers, and OS versions than hard-coded taps/coordinates/UI selectors. Separate research coverage on so-called “promptware” framed prompt injection as a distinct class of risk where an LLM can function as an execution engine; while conceptually related to AI-enabled abuse, that discussion focused on general LLM prompt-injection threats rather than the specific PromptSpy Android malware implementation using Gemini for UI manipulation and persistence.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On February 19, 2026, ESET publicly reported PromptSpy as the first known Android malware to use generative AI at runtime in its execution flow. The disclosure detailed its Gemini-based persistence technique, VNC remote-access capability, anti-removal behavior, and likely Argentina-focused financial-fraud distribution.
After analyzing the malware, ESET shared its findings with Google. Google Play Protect was reported to detect or block known PromptSpy versions, although the malware was not distributed through Google Play.
A more advanced PromptSpy variant incorporated Google's Gemini into its execution flow, using XML UI dumps and returned JSON instructions to pin itself in Android's Recent Apps list for persistence. The malware also used Accessibility Services, anti-uninstall overlays, and an embedded VNC module for remote control and spying.
Infrastructure distributing the malware was linked to dedicated websites impersonating JPMorgan Chase Bank under the 'MorganArg' branding, rather than Google Play. The setup suggested financially motivated targeting focused primarily on users in Argentina.
Researchers observed PromptSpy-related Android APK samples on VirusTotal in January, including submissions associated with Argentina. These samples helped establish the malware's existence and evolution toward Gemini-assisted persistence.
ESET identified an earlier variant related to PromptSpy, dubbed VNCSpy, indicating the malware family existed before the Gemini-assisted version. This earlier form focused on VNC-based remote access without the later generative-AI persistence enhancements.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcego.theregister.com
Open sourcewelivesecurity.com
Open sourcebleepingcomputer.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **PromptSpy**, a newly disclosed Android spyware and remote access trojan that uses **Google Gemini** during runtime to interpret on-screen elements and decide which gestures to perform on an infected device. The malware can steal lockscreen PINs and passwords, enumerate installed apps, capture screenshots, record video, and give operators live remote screen control over encrypted communications. Investigators said the AI-assisted navigation appears to be the first reported case of mobile malware directly invoking generative AI on a victim device while executing. PromptSpy was discovered by ESET during an investigation into a separate AI-enabled ransomware case and was distributed through a fake Argentine banking-themed website using app names such as **MorganArg** and **MorganArgs**, impersonating a JPMorgan Chase Argentina branch app. Telemetry indicates limited real-world deployment, with one confirmed detection in Ukraine in February 2026, suggesting the malware may still be an early-stage proof of concept. The spyware abuses Android accessibility services to keep itself pinned in the recent apps list and to hinder removal by placing invisible overlays over the **Stop** and **Uninstall** buttons, while Google Threat Intelligence Group said its Gemini-driven interaction is broader than persistence alone and that components including API keys can be updated remotely through command-and-control.
Jul 9, 2026
Google and Mandiant disclosed **PROMPTSPY**, an Android backdoor that uses AI-enabled functions to support credential theft, persistence, and operator resilience. The malware can capture biometric authentication input, display deceptive overlays to hinder removal, and relaunch remotely through Firebase Cloud Messaging. Investigators said operators can update command-and-control infrastructure, Gemini API keys, and VNC relay servers without redeploying the payload, allowing the malware to adapt after installation. Google said it disabled infrastructure tied to the activity, found no PROMPTSPY-infected apps on Google Play, and confirmed that Google Play Protect detects known samples. The report also described a broader rise in adversarial use of large language models and agentic tooling across the intrusion lifecycle. Google linked a suspected **PRC-nexus** actor to the use of tools including `Hexstrike`, `Graphiti`, `Strix`, `subfinder`, and `httpx` while targeting a Japanese technology company and an East Asian cybersecurity platform. Separately, the company said information operation actors tied to Russia, Iran, China, and Saudi Arabia are using AI for content generation, localization, reconnaissance, phishing preparation, environmental fingerprinting, and more autonomous attack workflows, including suspected AI voice cloning in the pro-Russia **Operation Overload** campaign.
Jun 29, 2026
Google's Threat Intelligence Group (GTIG) has identified a significant evolution in cybercriminal and nation-state tactics, with adversaries now leveraging Gemini AI to develop advanced malware and data processing agents. Notably, groups such as APT42 have experimented with Gemini to create a 'Thinking Robot' malware module capable of rewriting its own code during execution to evade detection, as well as AI agents that process and analyze sensitive personal data for surveillance and intelligence gathering. These developments mark a shift from previous uses of AI for productivity, such as phishing and translation, to direct integration of AI into malware operations. The experimental PromptFlux malware dropper exemplifies this trend, utilizing Gemini to dynamically generate obfuscated VBScript variants and periodically update its code to bypass antivirus defenses. PromptFlux attempts persistence via Startup folder entries and spreads through removable drives and network shares, while its 'Thinking Robot' module queries Gemini for new evasion techniques. Although PromptFlux is still in early development and not yet capable of causing significant harm, Google has proactively disabled its access to the Gemini API. Other AI-powered malware, such as FruitShell, have also been observed, indicating a broader move toward AI-driven, self-modifying threats in the wild.
Jun 29, 2026