PromptSpy Android Malware Taps Gemini AI to Adapt Across Devices and Evade Removal

First Android Malware Using Generative AI in Real-Time Execution

Security researchers at ESET have uncovered PromptSpy, marking a significant shift in how Android malware operates. This strain represents the first known case of malware using generative AI during its execution flow, specifically leveraging Google's Gemini chatbot to help it persist on infected devices1

1

. According to ESET researcher Lukas Stefanko, the malware sends predefined prompts to Gemini's API to interpret the user interface on infected devices and receive step-by-step instructions1

1

. While the Gemini component represents a relatively small portion of PromptSpy's overall capabilities, it performs a critical function that could expand the threat landscape significantly.

How PromptSpy Leverages Google's Gemini Chatbot to Maintain Persistence on Infected Devices

The malware's use of Gemini AI centers on a specific persistence mechanism: keeping the malicious app pinned in the recent apps list. PromptSpy sends Google's Gemini model a natural language prompt along with an XML dump of the current screen, including visible UI elements, text labels, class types, and screen coordinates3

3

. Gemini then responds with JSON-formatted instructions describing what action to take and where to perform it on the device3

3

. The malware executes these actions through Android's Accessibility Service, retrieves the updated screen state, and sends it back to Gemini in a loop until the AI confirms successful app locking3

3

. This approach allows the malware to dynamically adapt its behavior across different devices, layouts, and OS versions—something traditional Android malware struggles with when relying on hardcoded taps and coordinates2

2

.

VNC Module for Remote Control and Comprehensive Spyware Capabilities

While the AI-powered persistence is novel, PromptSpy's primary goal is deploying a VNC module that grants threat actors complete remote access and control over infected devices4

4

. Once Accessibility Service permissions are granted, the malware operators can see everything happening on the device and perform taps, swipes, gestures, and text input as though physically holding the phone1

1

. The spyware can intercept lockscreen PINs and passwords, capture the pattern unlock screen as video, record screen activity, take screenshots on demand, and gather comprehensive device information3

3

. Communication with a hard-coded command-and-control server at 54.67.2[.]84 occurs via the VNC protocol4

4

.

Anti-Uninstall Techniques Make Removal Challenging

PromptSpy employs sophisticated anti-uninstall techniques to prevent removal. The malware overlays transparent, invisible rectangles over specific screen areas when users attempt to uninstall the app or disable Accessibility permissions3

3

. These invisible overlays block taps on uninstall and force stop functions, making standard removal impossible1

1

. According to ESET, the only way victims can remove PromptSpy is by rebooting the device into Safe Mode, where third-party apps are disabled and can be uninstalled normally1

1

.

Distribution Through Phishing Site Targeting Argentina Users

ESET traced the malware to a phishing site at m-mgarg[.]com, which delivered PromptSpy through the related domain mgardownload[.]com1

1

. Both domains were found offline during the investigation, but cached versions revealed they impersonated the JPMorgan Chase Argentina banking brand2

2

. The malware uses similar branding, with the app name MorganArg and an icon inspired by Chase Bank, suggesting regional targeting focused on Argentina1

1

. ESET discovered PromptSpy after samples were uploaded from Argentina to VirusTotal in January 20261

1

. Analysis of the code reveals Chinese language strings, suggesting a hacker from China developed it, though the campaign appears financially motivated rather than state-sponsored4

4

.

Proof of Concept or Active Threat?

Whether PromptSpy represents an active threat or remains a proof of concept is unclear. ESET told BleepingComputer it hasn't observed the malware or its dropper in its telemetry, which could indicate both are only proofs of concept3

3

. However, the existence of dedicated distribution domains and a fake bank website suggests the malware may have been used in actual attacks3

3

. The malware was never found on the Google Play Store, and as an App Defense Alliance partner, ESET shared its findings with Google1

1

. Android users are automatically protected against known versions through Google Play Protect, which is enabled by default on devices with Google Play Services1

1

.

Broader Implications of Malware Using Generative AI

PromptSpy joins a growing list of threats incorporating generative AI into their operations. In November 2025, Google warned about Windows-based malware strains dubbed Promptflux and Promptsteal that also connect to generative AI models to execute instructions1

1

. Anthropic recently discovered hackers using its Claude AI chatbot to plan large-scale data extortion campaigns and develop ransomware1

1

. The finding demonstrates how threat actors are incorporating AI tools to automate actions that would be more challenging with conventional approaches, making malware far more dynamic and capable of real-time decision-making2

2

. For Android users, this evolution means watching for suspicious permission requests, avoiding sideloaded apps from unknown sources, and staying alert to phishing attempts impersonating legitimate banking institutions.