First Android malware discovered to use Google Gemini as part of the attack execution chain

ESET researchers have identified an Android malware sample that uses Google Gemini not merely as an auxiliary tool, but as an integral component of the attack execution chain. The newly discovered trojan, called PromptSpy, leverages generative artificial intelligence to automate on-device user interface navigation and to establish persistence.

According to the researchers, the malware submits an XML dump of the current screen to Gemini, including a detailed description of all UI elements (such as text strings, button types, and their positions). In response, the model returns step-by-step instructions in JSON format, specifying where to tap and which actions to perform next. This approach enables the trojan to keep its application in a “pinned” state within the Recent apps list, preventing the victim from closing it with a simple swipe. ESET notes that the technique makes the malware more universal: rather than relying on hard-coded coordinates, it can adapt to different Android versions, vendor UI shells, and screen sizes.

Once persistence is established, PromptSpy activates an embedded VNC module to obtain full remote-control capabilities over the device. The trojan is reported to be able to capture the screen-lock PIN and password, record on-screen activity as video, take screenshots, and collect device-related information. For command and control, it reportedly uses a hard-coded IP address associated with a C2 (command-and-control) server. Access to Gemini is provided via an API key, which the malware retrieves from its server.

To resist removal, the malware makes extensive use of Android Accessibility services and applies invisible overlay layers on top of the interface. As a result, attempts to uninstall the application through standard methods are ineffective. The primary remediation method described is to reboot the device into Safe Mode and remove the application from within that environment.

ESET further reports that the campaign appears to be financially motivated. PromptSpy is distributed outside of Google Play via a dedicated website. Victims are prompted to install an “update” presented as MorganArg, an alleged imitation of JPMorgan Chase Argentina. After installation, a dropper component requests permission to install applications from unknown sources and then downloads and installs the main malicious payload. During analysis, researchers also found debugging strings written in Simplified Chinese, which may indicate a Chinese-language development environment. ESET adds that PromptSpy may represent a more advanced iteration of another Android malware family, VNCSpy, whose samples were observed on VirusTotal last month.