ESET researchers published their analysis of PromptSpy this week, the first known Android malware to use a generative AI model during execution. The malware calls Google’s Gemini API at runtime, sending it an XML dump of the infected device’s screen, including UI elements, text labels, class types, and screen coordinates. Gemini responds with step-by-step instructions for how to pin the malicious app in the recent apps list, navigate settings menus, and maintain persistence across different Android versions and device manufacturers.
Read that again. The malware doesn’t contain hardcoded navigation paths for every possible Android configuration. It asks an AI to figure it out on the fly. That’s a meaningful technical shift.
How It Works
PromptSpy started life as VNCSpy, a more conventional remote access trojan that appeared on VirusTotal on January 13 from Hong Kong. By February 10, four more advanced samples appeared from Argentina. The upgrade between versions was the Gemini integration.
The core functionality is spyware. Once installed (it masquerades as “MorganArg,” a fake Morgan Chase banking app distributed through a dedicated website, never through Google Play), it requests Accessibility Services permissions. With those permissions granted, it deploys a VNC module that gives the operators full remote access to the device. It can capture lockscreen data, block uninstallation attempts by throwing invisible overlays over the settings screen, gather device information, take screenshots, and record video of everything happening on screen. Command and control communications are encrypted with AES.
The Gemini component handles the persistence problem. Android fragmentation means that the path to pin an app in the recent apps list, or to navigate to the settings screen to block uninstallation, is different on a Samsung running Android 14 versus a Pixel running Android 15 versus a Xiaomi running MIUI. Traditionally, malware authors had to hardcode paths for each device configuration or limit their targeting to specific manufacturers. PromptSpy outsources that problem to Gemini. Feed it the screen layout, get back the tap coordinates. Works on any device that Gemini has seen training data for, which is effectively all of them.
The Bigger Pattern
PromptSpy is technically a proof of concept. ESET hasn’t detected it in active telemetry yet, and its distribution is limited. But the technique it demonstrates is immediately replicable by any malware author with a Gemini API key. And getting a Gemini API key is trivial. Google gives them away.
This connects to a pattern that’s been building for months. In January, security researcher Michael Bargury published work showing that Microsoft’s Copilot could be exploited to bypass Data Loss Prevention controls, extracting sensitive data from organizations that assumed their DLP policies covered AI tool interactions. They didn’t. Microsoft had shipped Copilot as a productivity tool without engineering the security boundaries that organizations depend on to prevent data exfiltration.
The common thread isn’t any specific vulnerability. It’s the order of operations. AI capabilities ship first. Security engineering happens later, if it happens at all. Google made Gemini’s API accessible because accessibility drives adoption. Microsoft integrated Copilot into the enterprise stack because integration drives revenue. In both cases, the security implications were secondary to the business objective of getting the tool into as many hands and systems as possible.
PromptSpy is what happens when the “accessible to everyone” part includes malware developers. Bargury’s Copilot research is what happens when the “integrated everywhere” part includes data you’re legally required to protect. Neither represents a failure of security engineering. Both represent the absence of it at the point where it mattered most.
What Comes Next
The obvious next step is malware that doesn’t just use AI for navigation but for decision-making. A trojan that evaluates what’s on screen to decide whether to exfiltrate banking credentials or cryptocurrency wallet phrases. A phishing kit that uses an LLM to generate personalized social engineering in real time based on the victim’s recent messages. A worm that uses AI to identify which lateral movement path through a network is least likely to trigger detection.
All of these are technically feasible today. PromptSpy proved the integration pattern works. The cost is a Gemini API call, maybe a fraction of a cent per inference. The barrier to entry just dropped from “skilled malware developer” to “anyone who can write a prompt.”
Google’s response will probably involve restricting API access for certain use cases, the same way they restrict advertising APIs. But content-based restrictions on API usage are reactive by nature. You can’t distinguish between a legitimate developer building an accessibility app that reads screen layouts and a malware developer building a trojan that does the same thing. The API call is identical. The intent is invisible.
The security industry has spent two years talking about AI-powered defense. PromptSpy is the other side of that equation arriving exactly on schedule. Every capability that makes AI tools useful for productivity makes them equally useful for exploitation. The only variable is who builds the integration first.