Loading story…
Google and Mandiant disclosed PROMPTSPY, an Android backdoor that uses AI-enabled functions to support credential theft, persistence, and operator resilience. The malware can capture biometric authentication input, display deceptive overlays to hinder removal, and relaunch remotely through Firebase Cloud Messaging. Investigators said operators can update command-and-control infrastructure, Gemini API keys, and VNC relay servers without redeploying the payload, allowing the malware to adapt after installation. Google said it disabled infrastructure tied to the activity, found no PROMPTSPY-infected apps on Google Play, and confirmed that Google Play Protect detects known samples.
The report also described a broader rise in adversarial use of large language models and agentic tooling across the intrusion lifecycle. Google linked a suspected PRC-nexus actor to the use of tools including Hexstrike, Graphiti, Strix, subfinder, and httpx while targeting a Japanese technology company and an East Asian cybersecurity platform. Separately, the company said information operation actors tied to Russia, Iran, China, and Saudi Arabia are using AI for content generation, localization, reconnaissance, phishing preparation, environmental fingerprinting, and more autonomous attack workflows, including suspected AI voice cloning in the pro-Russia Operation Overload campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The report noted that information operation actors linked to Russia, Iran, China, and Saudi Arabia are using AI for content generation and localization. It also cited suspected AI voice cloning in the pro-Russia Operation Overload campaign.
Mandiant reported that threat actors are using large language models and agentic tooling for reconnaissance, phishing preparation, environmental fingerprinting, vulnerability exploitation, and autonomous attack workflows. The report also highlighted a suspected PRC-nexus actor using tools including Hexstrike, Graphiti, Strix, subfinder, and httpx against a Japanese technology firm and an East Asian cybersecurity platform.
Google identified activity involving the PROMPTSPY Android backdoor, which used AI-enabled capabilities to capture biometric authentication inputs, maintain persistence, and resist removal. Google said it disabled assets associated with the activity, found no PROMPTSPY-infected apps on Google Play, and that Google Play Protect detects known versions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourceanrdoezrs.net
Open sourcecloud.google.com
Open sourcethecyberexpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **PromptSpy**, a newly disclosed Android spyware and remote access trojan that uses **Google Gemini** during runtime to interpret on-screen elements and decide which gestures to perform on an infected device. The malware can steal lockscreen PINs and passwords, enumerate installed apps, capture screenshots, record video, and give operators live remote screen control over encrypted communications. Investigators said the AI-assisted navigation appears to be the first reported case of mobile malware directly invoking generative AI on a victim device while executing. PromptSpy was discovered by ESET during an investigation into a separate AI-enabled ransomware case and was distributed through a fake Argentine banking-themed website using app names such as **MorganArg** and **MorganArgs**, impersonating a JPMorgan Chase Argentina branch app. Telemetry indicates limited real-world deployment, with one confirmed detection in Ukraine in February 2026, suggesting the malware may still be an early-stage proof of concept. The spyware abuses Android accessibility services to keep itself pinned in the recent apps list and to hinder removal by placing invisible overlays over the **Stop** and **Uninstall** buttons, while Google Threat Intelligence Group said its Gemini-driven interaction is broader than persistence alone and that components including API keys can be updated remotely through command-and-control.
Jul 9, 2026
**ESET** reported a new Android malware family, **PromptSpy**, assessed as the first known Android malware to incorporate **generative AI** directly into its execution flow to improve reliability of on-device actions. PromptSpy uses predefined prompts to **Google’s Gemini** to interpret the device UI and guide gestures that keep the malicious app “locked”/pinned in the **recent apps** view (often shown as a padlock icon), making it harder for users or the OS to dismiss and aiding persistence. Reported capabilities include collecting device information, taking screenshots, recording screen activity, capturing lockscreen data, and interfering with uninstallation attempts; ESET noted it has not been observed in their telemetry and may currently be a **proof of concept**, with indicators suggesting a financially motivated campaign primarily affecting users in **Argentina**. Technical reporting described PromptSpy sending Gemini an **XML dump** of the current screen and receiving **JSON** instructions indicating what action to take and where, iterating until the app is successfully pinned—an approach that can be more adaptable across device models, launchers, and OS versions than hard-coded taps/coordinates/UI selectors. Separate research coverage on so-called **“promptware”** framed prompt injection as a distinct class of risk where an LLM can function as an execution engine; while conceptually related to AI-enabled abuse, that discussion focused on general LLM prompt-injection threats rather than the specific PromptSpy Android malware implementation using Gemini for UI manipulation and persistence.
Jun 29, 2026
Multiple mobile-focused threats were reported spanning **Android banking malware**, **iOS credential-harvesting via App Store listings**, and **Android espionage via trojanized crisis apps**. A new Android banking trojan marketed as **Mirax Bot** was advertised on underground forums as a **Malware-as-a-Service (MaaS)** offering, with claimed capabilities including **700+ app injects**, **Hidden VNC (HVNC)** for stealthy remote control, and features positioned for **account takeover (ATO)** and large-scale financial fraud; researchers noted the feature list is based on seller claims and not yet independently verified. Separately, researchers described **PromptSpy**, characterized as an Android threat that uses **generative-AI techniques** to improve phishing and fraud by generating more convincing social-engineering content and automating deceptive interactions on-device. In parallel, a phishing operation targeted iPhone users by impersonating **ChatGPT** and **Google Gemini** in emails that directed victims to **fraudulent iOS apps hosted on Apple’s App Store**; the apps (including *GeminiAI Advertising* `id6759005662` and *Ads GPT* `id6759514534`) presented a fake **Facebook login** flow to harvest credentials. Another campaign, **RedAlert**, weaponized a trojanized version of Israel’s “Red Alert” emergency app distributed as `RedAlert.apk` via **SMS phishing (smishing)**, pushing victims to sideload the APK; analysis reported the app mimicked the legitimate interface while requesting high-risk permissions (e.g., **SMS**, contacts, precise **GPS**) consistent with covert surveillance and data theft. A separate Kaspersky post focused on consumer guidance for disabling AI assistants and broader privacy concerns, and does not materially add incident-specific threat intelligence to the mobile malware/phishing reporting.
Jun 29, 2026