Android malware PromptSpy uses Google Gemini for persistence and remote access
ESET researchers discovered PromptSpy, reportedly the first Android malware to use generative AI in its execution flow, specifically Google's Gemini API to help maintain persistence on compromised devices. The malware primarily targets users in Argentina and deploys a VNC module for remote access, while using Gemini to interpret on-screen elements and provide step-by-step instructions to keep the malicious app pinned in the recent apps list.
What happened
ESET researchers discovered PromptSpy, which they describe as the first known Android malware to abuse generative AI in its execution flow to achieve persistence.
The malware sends predefined prompts to Google's Gemini API to interpret on-screen elements and receive step-by-step instructions on how to keep the malicious app pinned in the recent apps list, preventing it from being easily removed or killed by the system.
PromptSpy deploys a Virtual Network Computing (VNC) module that allows attackers to see the screen and perform actions remotely. The malware can capture lockscreen data, block uninstallation attempts, gather device information, take screenshots, and record screen activity as video.
Reported impact
ESET observed that PromptSpy appears to be financially motivated and primarily targets users in Argentina. Evidence suggests the malware was distributed through phishing sites impersonating JPMorgan Chase Argentina, with the malicious app named MorganArg.
ESET has not observed PromptSpy in its telemetry, suggesting it may be a proof of concept. However, ESET notes that leveraging generative AI for UI navigation enables threat actors to adapt to various device layouts and OS versions, potentially expanding the pool of victims.
Index analysis
This is the second AI-powered malware discovered by ESET Research, following PromptLock in August 2025, which was the first known case of AI-driven ransomware.
While generative AI is deployed only in a relatively minor part of PromptSpy's code responsible for persistence, ESET states it has a significant impact on the malware's adaptability. The AI model and prompt are predefined in the code and cannot be changed.
Governance controls
Malware samples were uploaded to Google's malware-checking service VirusTotal from Argentina in February 2026. The phishing domains used for distribution (m-mgarg[.]com and mgardownload[.]com) were found offline.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.