Android Malware Leverages Generative AI for Advanced Threats: PromptSpy Breakthrough
Researchers Discover New Android Malware Family “PromptSpy” that Utilizes AI
Researchers have identified a new Android malware family, dubbed PromptSpy, which leverages generative AI to enhance its persistence on infected devices. This marks the first known instance of Android malware utilizing AI in its execution flow.
PromptSpy’s Execution Flow and Functionality
PromptSpy employs Google’s Gemini model to adapt to different devices and evade detection. The malware sends a chat prompt, along with an XML dump of the current screen, to the Gemini model. The model responds with JSON-formatted instructions, which the malware executes through Android’s Accessibility Service. This process is repeated until the AI confirms that the app has been successfully locked in the recent apps list.
The primary functionality of PromptSpy is to act as spyware, allowing threat actors to gain full remote access to devices with Accessibility permissions. The malware includes a built-in VNC module, enabling threat actors to view and control the Android screen in real-time. PromptSpy can also upload a list of installed apps, intercept lockscreen PINs or passwords, record the pattern unlock screen as a video, capture screenshots on demand, and report the current foreground application and screen status.
Removal and Distribution
To hinder removal, PromptSpy overlays transparent, invisible rectangles over UI buttons, blocking users from uninstalling the app or turning off Accessibility permissions. Victims must reboot into Android Safe Mode to disable third-party apps and uninstall the malware.
While the distribution of PromptSpy appears limited, it highlights how threat actors are utilizing generative AI to modify malware behavior in real-time. The use of AI in malware development is becoming increasingly prevalent, with threat actors exploiting AI tools to create attacks and phishing sites.
Discovery and Analysis
Researchers first discovered PromptSpy in February 2026, with two versions of the malware uploaded to VirusTotal. The first version, VNCSpy, appeared on January 13th, 2026, with three samples uploaded from Hong Kong. A more advanced version was uploaded on February 10th, 2026, with four samples from Argentina.
The dedicated domain “mgar” was used to distribute PromptSpy, and a fake bank website was also identified. Although it is unclear whether PromptSpy is a proof-of-concept or a actively distributed malware, its existence demonstrates the evolving threat landscape and the need for increased vigilance in the face of AI-powered malware.
About Author
English