PromptSpy: First Android Malware to Use Gemini API for Persistence

In February 2026, ESET researchers published analysis of a previously undocumented Android malware family that crossed a line the security community had been waiting for: PromptSpy is the first known piece of malware to call a live generative AI API during active execution. Not at build time. Not as a development aid. At runtime, while running on infected devices, the malware queries Google’s Gemini model for gesture instructions it uses to maintain persistence. GTIG’s mid-2026 AI Threat Tracker subsequently cited PromptSpy as a representative example of the emerging class of AI-augmented malware — autonomous families that generate runtime commands from model outputs rather than relying on hardcoded logic.

The immediate impact is limited. ESET found no evidence of widespread deployment. But the technique matters because it demonstrates that the boundary between AI tool and AI-augmented malware has been crossed at the implementation level, not just in research papers.

The VNCSpy Foundation

PromptSpy evolved from an earlier strain ESET named VNCSpy. The first samples appeared on VirusTotal on January 13, 2026, uploaded from Hong Kong. Three samples of VNCSpy established the core architecture: a VNC module that gives attackers remote access to the infected device’s screen, enabling live viewing and gesture control.

Four samples of the more advanced PromptSpy variant appeared on VirusTotal on February 10, 2026, uploaded from Argentina. The primary payload remained the same VNC capability. What changed was how the malware maintained its presence on the device long enough to be useful.

The operational goal is financial. Droppers distributed under the name “MorganArg” impersonated Chase Bank. A companion phishing trojan, sharing signing certificates with PromptSpy, hosted fake Spanish-language banking sites. The certificate linkage ties both components to the same operator infrastructure. The Argentina upload origin, combined with Spanish-language banking impersonation, points to Argentine financial institution customers as the intended victims. The development artifacts tell a different story: debug strings in simplified Chinese and Accessibility API event handlers for Chinese locale suggest the authors work in a Chinese-speaking environment. ESET did not attribute the campaign to a specific known threat actor.

How Gemini Powers Persistence

The novel component is the persistence mechanism. Android’s recent apps list presents a problem for malware: if the user swipes the malicious app away from the recents view, or if Android’s memory management removes it, the malware loses its footing. Maintaining a presence in the recent apps list is one way to keep the process alive and appear as a legitimate recently used app.

Traditional approaches to this use hardcoded UI coordinates or accessibility service hooks with static logic. The problem is that Android UI layouts vary across device manufacturers, Android versions, and screen sizes. Hardcoded coordinate attacks break when the UI doesn’t match expectations.

PromptSpy sidesteps this fragility by asking Gemini to figure it out at runtime. When the malware needs to perform a persistence gesture, it does the following:

1. Captures the current screen state as an XML dump, including element types, text labels, class names, and screen coordinates for all visible UI components.
2. Constructs a prompt that describes what it needs to accomplish — adding itself to the recent apps list — and attaches the XML.
3. Sends the prompt to the Gemini API.
4. Receives a JSON response specifying the gesture to perform: which element to tap or swipe, and where on screen.
5. Executes the gesture.

This approach adapts to any Android UI configuration. The malware doesn’t need to know in advance what the device looks like. Gemini handles the interpretation. The result is a persistence mechanism that is more robust across device heterogeneity than any static implementation could be.

The Gemini API key is embedded in the malware. This is both a technical limitation and a forensic opportunity: the key is attributable, rate-limitable, and revocable by Google. ESET notified Google following the disclosure.

Why This Matters Beyond PromptSpy

The significance of PromptSpy is not its sophistication as a banking trojan. VNC-based remote access malware is common. The significance is architectural: an operational piece of malware now queries a frontier AI model as part of its execution logic.

There are several implications that extend past this specific family.

Adaptive malware at scale. Hardcoded malware logic breaks when environments don’t match expectations. AI-queried malware can adapt to environmental variation in real time. The Android UI case is narrow, but the same principle applies to any scenario where malware needs to make context-aware decisions: filesystem layout reconnaissance, identifying security product UI to disable, navigating enterprise software to find and exfiltrate data. Static logic fails unpredictably. AI-queried logic degrades more gracefully.

API abuse as an attack surface. Malware using commercial AI APIs means those APIs are part of the attack infrastructure. API key revocation becomes a disruption technique. Rate limiting becomes a degradation technique. Monitoring for anomalous API usage patterns from mobile IP ranges becomes a detection opportunity. Security teams and AI providers will need to develop shared signals for identifying malicious API usage.

Defense against a moving target. Standard Android malware detection looks for known malicious code patterns, suspicious permissions, anomalous network traffic, and known bad infrastructure. PromptSpy’s Gemini API calls look, at the network level, like legitimate API traffic. The malicious behaviour emerges from the combination of the local malware code and the remote AI responses — neither of which is individually detectable by content alone. This is a new signature problem.

Detection and Defensive Guidance

For mobile security teams, several detection signals apply to PromptSpy and the emerging class of AI-augmented mobile malware.

API traffic monitoring. Outbound calls to Gemini API endpoints (generativelanguage.googleapis.com) from apps that have no user-facing AI features are suspicious. Enterprise mobile device management platforms with network inspection capabilities should flag unexpected AI API traffic from business devices.

Permission analysis. PromptSpy requires Accessibility Services to perform gesture injection. Combined with screen capture permissions and VNC-related network activity, this permission cluster is a high-fidelity signal in enterprise MDM deployments.

Sideloading controls. PromptSpy was not observed in the Google Play Store. Distribution was through phishing droppers impersonating banking apps. Restricting Android device profiles to Play Store installations, with Unknown Sources blocked, removes the primary distribution vector.

Signing certificate tracking. The shared signing certificate between PromptSpy and the companion phishing trojan allowed ESET to link the infrastructure. Enterprise mobile threat defence products that track certificate chains can extend initial detections to related samples automatically.

The ESET WeLiveSecurity technical write-up includes full IOC sets for both VNCSpy and PromptSpy, including package names, signing certificate hashes, and Gemini API key identifiers from the analysed samples. Teams with Android device management responsibilities should pull those indicators.

References

• ESET WeLiveSecurity: PromptSpy ushers in the era of Android threats using GenAI
• ESET Research: PromptSpy is the first Android threat to use generative AI
• BleepingComputer: PromptSpy is the first known Android malware to use generative AI at runtime
• GTIG AI Threat Tracker: Distillation, Experimentation, and Integration of AI for Adversarial Use
• The Hacker News: PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence