PromptSpy: First Android Malware to Weaponize Generative AI

A New Class of Mobile Threat

ESET Research has published findings on PromptSpy, the first documented Android malware family to integrate generative AI into its execution flow. Unlike traditional mobile malware that relies on hardcoded UI automation scripts, PromptSpy queries Google's Gemini AI at runtime to dynamically navigate the infected device's interface — adapting to any manufacturer, Android version, or screen layout.

The discovery marks a paradigm shift: malware that can think its way through a device rather than following predetermined paths.

How PromptSpy Uses Gemini

The malware's core innovation is replacing brittle UI automation with AI-driven navigation:

Traditional Android Malware

1. Hardcode screen coordinates and UI element IDs
2. Break when device manufacturer changes UI layout
3. Break when Android version updates rearrange settings
4. Require manual updates for each new device/OS combination

PromptSpy's AI Approach

1. Capture current screen state
2. Send screen context to Gemini API
3. Receive step-by-step navigation instructions
4. Execute instructions dynamically
5. Adapt to ANY device, layout, or OS version automatically

This means PromptSpy can maintain persistence on devices it has never seen before, because Gemini provides real-time guidance based on the actual screen content.

Primary Capabilities

Technical Deep Dive

AI-Driven Persistence Mechanism

The most notable use of Gemini is for persistence. PromptSpy prompts the AI model to analyze the current screen and provide instructions on how to ensure the malicious app remains pinned in the recent apps list, preventing it from being swiped away or killed by the system's memory management.

Two Known Variants

ESET identified two versions of PromptSpy:

Distribution

• Distributed through a dedicated website (not Google Play)
• A likely distribution domain suggests a variant targeting users in Argentina
• Not yet observed in ESET telemetry in the wild — may still be in proof-of-concept or limited deployment stage

Why This Matters

The Scalability Problem

Traditional Android malware requires developers to maintain scripts for hundreds of device-manufacturer combinations. PromptSpy eliminates this entirely — the AI handles device-specific navigation automatically, dramatically expanding the pool of potential victims.

Defense Evasion

By using a legitimate API (Gemini) for its navigation logic, PromptSpy's malicious behavior is harder to fingerprint. The malware's actions appear as standard API calls to a Google service rather than suspicious automated UI interactions.

A Blueprint for Future Threats

Even if PromptSpy itself remains limited in deployment, it demonstrates a replicable technique that other threat actors will adopt. The pattern of using generative AI for runtime adaptation applies to:

• Banking trojans that need to navigate banking app interfaces
• Spyware that must access specific settings to grant itself permissions
• Ransomware that needs to navigate to disable security features

Defense Recommendations

For Users

1. Only install apps from Google Play — PromptSpy is distributed via third-party websites
2. Keep Google Play Protect enabled — It provides runtime scanning for malicious behavior
3. Review app permissions carefully — VNC and accessibility service permissions are red flags
4. Monitor data usage — VNC and screen recording generate unusual network traffic

For Security Teams

1. Monitor for unusual Gemini API calls from mobile devices in your fleet
2. Deploy mobile threat defense (MTD) solutions that detect accessibility service abuse
3. Block sideloading on managed devices via MDM policy
4. Update threat intelligence to include PromptSpy IOCs from ESET's report

Key Takeaways

1. First AI-powered Android malware — PromptSpy uses Gemini to navigate device UIs dynamically
2. Device-agnostic persistence — Works on any manufacturer, Android version, or screen layout
3. VNC remote access is the primary payload — Full device control for the operator
4. Not yet widespread — But the technique is a proven blueprint for future threats
5. Sideloading is the vector — Google Play users are not currently at risk

Sources

• ESET Research — PromptSpy Ushers In the Era of Android Threats Using GenAI
• BleepingComputer — PromptSpy Is the First Known Android Malware to Use Generative AI at Runtime
• The Hacker News — PromptSpy Android Malware Abuses Gemini AI
• SecurityWeek — PromptSpy Android Malware Abuses Gemini AI at Runtime for Persistence

Related Reading

• Android March 2026 Security Update Patches 129
• ZeroDayRAT Mobile Spyware Enables Total Surveillance of iOS
• Samsung Ends Software Support for Galaxy S21 Series