{"id":63,"date":"2026-03-15T07:53:01","date_gmt":"2026-03-15T07:53:01","guid":{"rendered":"https:\/\/escudodigital.uy\/index.php\/2026\/03\/15\/promptspy-ushers-in-the-era-of-android-threats-using-genai\/"},"modified":"2026-03-15T07:53:01","modified_gmt":"2026-03-15T07:53:01","slug":"promptspy-ushers-in-the-era-of-android-threats-using-genai","status":"publish","type":"post","link":"https:\/\/escudodigital.uy\/index.php\/2026\/03\/15\/promptspy-ushers-in-the-era-of-android-threats-using-genai\/","title":{"rendered":"PromptSpy ushers in the era of Android threats using GenAI"},"content":{"rendered":"
\n

ESET researchers uncovered the first known case of Android malware abusing generative AI for context-aware user interface manipulation. While machine learning has been used to similar ends already \u2013 just recently, researchers at Dr.WEB found Android.Phantom<\/a>, which uses TensorFlow machine learning models to analyze advertisement screenshots and automatically click on detected elements for large scale ad fraud \u2013 this is the first time we have seen generative AI deployed in this manner. Because the attackers rely on prompting an AI model (in this instance, Google\u2019s Gemini) to guide malicious UI manipulation, we have named this family PromptSpy. This is the second AI powered malware we have discovered \u2013 following PromptLock in August 2025, the first known case of AI-driven ransomware.<\/p>\n

While generative AI is deployed only in a relatively minor part of PromptSpy’s code \u2013 that responsible for achieving persistence \u2013 it still has a significant impact on the malware’s adaptability. Specifically, Gemini is used to analyze the current screen and provide PromptSpy with step-by-step instructions on how to ensure the malicious app remains pinned in the recent apps list, thus preventing it from being easily swiped away or killed by the system. The AI model and prompt are predefined in the code and cannot be changed. Since Android malware often relies on UI navigation, leveraging generative AI enables the threat actors to adapt to more or less any device, layout, or OS version, which can greatly expand the pool of potential victims.<\/p>\n

The main purpose of PromptSpy is to deploy a built-in VNC module, giving operators remote access to the victim\u2019s device. This Android malware also abuses the Accessibility Service to block uninstallation with invisible overlays, captures lockscreen data, records video. It communicates with its C&C server via the VNC protocol, using AES encryption.<\/p>\n

Based on language localization clues and the distribution vectors observed during analysis, this campaign appears to be financially motivated and seems to primarily target users in Argentina. Interestingly, analyzed PromptSpy samples suggest that it was developed in a Chinese\u2011speaking environment.<\/p>\n

PromptSpy is distributed by a dedicated website and has never been available on Google Play. As an App Defense Alliance partner, we nevertheless shared our findings with Google. Android users are automatically protected against known versions of this malware by Google Play Protect<\/a>, which is enabled by default on Android devices with Google Play Services.<\/p>\n

\n

Key points of this blogpost:<\/strong><\/p>\n