Stay ahead with breaking tech news, gadget reviews, AI & software innovations, cybersecurity tips, start‑up trends, and step‑by‑step how‑tos.
.jpg)
A new Android malware family dubbed “PromptSpy” is making headlines as the first known instance of malicious software utilizing generative AI during its operation. Researchers at ESET have discovered that PromptSpy leverages Google’s Gemini large language model to automate tasks, specifically to maintain its persistence on compromised devices – making it harder for users to remove.
The malware, first observed in samples uploaded to VirusTotal in January and February 2026, demonstrates a novel approach to bypassing Android’s security measures. While previous Android malware has used machine learning for tasks like ad fraud, PromptSpy marks the first time generative AI has been directly integrated into the malware’s execution flow, according to ESET’s report published on February 19, 2026.
PromptSpy’s core innovation lies in its ability to adapt to the varying methods Android manufacturers employ for “pinning” apps in the recent apps list. This feature, intended to prevent legitimate apps from being terminated by the system, is exploited by the malware to ensure its continued operation. Because the pinning process differs across devices, traditional scripting methods are unreliable. This is where Gemini comes into play.
The malware sends a prompt to Google’s Gemini, along with an XML dump of the current screen, detailing the visible UI elements, text labels, and their positions. Gemini then analyzes this information and responds with JSON-formatted instructions outlining the steps needed to pin the app. PromptSpy then executes these instructions using Android’s Accessibility Service, repeatedly sending screen updates to Gemini until the app is successfully locked in the recent apps list.
How PromptSpy Works: AI-Powered Persistence
ESET researcher Lukas Štefanko explains that while Gemini is currently used for only one aspect of PromptSpy’s functionality – achieving persistence – it highlights the potential for AI to make malware more adaptable and automate complex tasks. “Even though PromptSpy uses Gemini in just one of its features, it still demonstrates how incorporating these AI tools can make malware more dynamic, giving threat actors ways to automate actions that would normally be more challenging with traditional scripting,” Štefanko stated in the ESET report.
Yet, the AI component isn’t the malware’s primary function. PromptSpy is, at its core, spyware. It includes a built-in Virtual Network Computing (VNC) module, granting attackers remote access to the infected device. With Accessibility permissions granted, attackers can view and control the Android screen in real-time. According to ESET, the malware is capable of:
- Uploading a list of installed apps
- Intercepting lockscreen PINs or passwords
- Recording the pattern unlock screen as a video
- Capturing screenshots on demand
- Recording screen activity and user gestures
- Reporting the current foreground application and screen status
Bypassing Removal Attempts
To further complicate removal, PromptSpy employs a deceptive tactic when users attempt to uninstall the app or disable Accessibility permissions. The malware overlays transparent, invisible rectangles over UI buttons labeled “stop,” “end,” “clear,” and “Uninstall.” Tapping these buttons instead activates the invisible overlays, preventing the user from successfully removing the malware. ESET recommends that victims reboot their devices into Android Safe Mode to disable third-party apps and circumvent this blocking mechanism.
Limited Distribution, Potential for Wider Attacks
Currently, it remains unclear whether PromptSpy is a fully operational threat or a proof-of-concept. ESET has not yet detected the malware or its dropper in its telemetry. However, the discovery of dedicated domains – mgardownload[.]com and m-mgarg[.]com – used to distribute samples and a website impersonating JPMorgan Chase Bank suggests potential real-world deployment, according to The Hacker News. Štefanko noted to BleepingComputer, “We haven’t seen any signs of the PromptSpy dropper or its payload in our telemetry so far, which could mean they’re only proofs of concept… Still, because there appears to be a dedicated domain that was used to distribute them, and fake bank website, we can’t rule out the possibility that both the dropper and PromptSpy are or were in the wild.”
Implications for Mobile Security
The emergence of PromptSpy signals a concerning trend: the integration of generative AI into mobile malware. While the current implementation is limited, it demonstrates the potential for threat actors to leverage AI to create more sophisticated and adaptable attacks. This development aligns with recent reports from PCMag and others indicating that state-sponsored hackers are also exploring the use of AI models like Gemini to enhance their cyber operations. As AI technology becomes more accessible, it is likely that we will notice further innovation in the use of AI by malicious actors, requiring a continued focus on proactive security measures and threat intelligence.
The development of PromptSpy underscores the need for vigilance in the mobile security landscape. Users should exercise caution when installing applications, particularly from untrusted sources, and regularly review app permissions. The ongoing evolution of AI-powered threats will undoubtedly require a continuous adaptation of security strategies to stay ahead of emerging risks.
