We recently reviewed new research from ESET<\/b>, which has identified an Android malware family dubbed PromptSpy<\/i>. According to ESET researcher Luk\u00e1\u0161 \u0160tefanko<\/b>, this appears to be the first observed Android malware sample using generative AI to maintain persistence on infected devices.<\/p>\n
The discovery is notable not because AI is controlling the entire attack, but because of how it is being used: to adapt to user interfaces dynamically and make the malware harder to remove.<\/p>\n
<\/p>\n
PromptSpy uses Google\u2019s Gemini generative AI model<\/b> to interpret what appears on a device\u2019s screen and return instructions for user interface gestures. It then uses those instructions to keep the malicious app locked in the \u201crecent apps\u201d view.<\/p>\n
On many Android devices, users can pin or lock apps in the recent apps screen \u2014 often indicated by a padlock icon. PromptSpy leverages AI to identify those interface elements and determine the steps required to keep itself locked in that position.<\/p>\n
This makes it harder for users to remove the app simply by swiping it away or relying on standard Android behaviour.<\/p>\n
As \u0160tefanko explained:<\/p>\n
\n\n\u201cSince Android malware often relies on UI-based navigation, leveraging generative AI enables threat actors to adapt to more or less any device, layout, or operating system version, which can greatly increase the pool of potential victims.\u201d\n<\/p>\n
<\/cite><\/p><\/blockquote>\n
The generative AI component is predefined in the malware\u2019s code and cannot be modified without updating the malware itself. While limited to the persistence function, this approach demonstrates how AI can make malware more flexible across different Android versions and device layouts.<\/p>\n
<\/p>\n
Remote Access Capabilities<\/h2>\n
Beyond AI-assisted persistence, PromptSpy includes more traditional remote-access features.<\/p>\n
The malware contains a built-in Virtual Network Computing (VNC) module<\/b>, giving attackers remote visibility of the device screen and allowing them to perform actions directly on the handset.<\/p>\n
According to ESET, PromptSpy can:<\/p>\n
\n
- \nCapture lockscreen data\n<\/li>\n
- \nCollect device information\n<\/li>\n
- \nTake screenshots\n<\/li>\n
- \nRecord screen activity as video\n<\/li>\n
- \nCommunicate with command-and-control servers using AES encryption\n<\/li>\n<\/ul>\n
These capabilities are often associated with account takeover activity, particularly targeting mobile banking users.<\/p>\n
<\/p>\n
Blocking Uninstallation<\/h2>\n
PromptSpy abuses Android Accessibility Services and screen overlays to resist removal.<\/p>\n
It places invisible overlays over parts of the screen, interfering with user taps during the uninstall process. This makes it appear as if the device is malfunctioning when users attempt to remove the app.<\/p>\n
ESET recommends rebooting the device into Safe Mode<\/b>, which disables third-party apps and prevents the overlays from running. From Safe Mode, users can navigate to Settings \u2192 Apps, select the malicious app (named MorganArg<\/i> in this case), and uninstall it.<\/p>\n
Steps may vary slightly depending on the device manufacturer.<\/p>\n
<\/p>\n
Distribution and Targeting<\/h2>\n
PromptSpy has been distributed through a dedicated website and has not appeared on Google Play. ESET shared its findings with Google through the App Defence Alliance.<\/p>\n
Google Play Protect blocks known versions of the malware on devices with Google Play Services enabled.<\/p>\n
ESET\u2019s analysis suggests the campaign is financially motivated and primarily targeting users in Argentina. The malicious app impersonates a banking brand and uses the name MorganArg<\/i>, with an icon resembling Morgan Chase branding.<\/p>\n
The researchers note that PromptSpy has not yet appeared in broader telemetry, which may indicate a limited campaign or a proof-of-concept operation.<\/p>\n
<\/p>\n
Why This Matters<\/h2>\n
The AI component in PromptSpy is currently limited to improving persistence. However, it signals a shift in how malware authors may use generative AI in the future.<\/p>\n
Rather than replacing traditional malware techniques, AI may enhance them by:<\/p>\n
\n
- \nAdapting automatically to different device layouts\n<\/li>\n
- \nAutomating interaction sequences\n<\/li>\n
- \nReducing the need for device-specific scripting\n<\/li>\n<\/ul>\n
\u0160tefanko noted:<\/p>\n
\n\n\u201cEven though PromptSpy uses Gemini in just one of its features, it still demonstrates how implementing these tools can make malware more dynamic, giving threat actors ways to automate actions that would normally be more difficult with traditional scripting.\u201d\n<\/p>\n
<\/cite><\/p><\/blockquote>\n
CSB Perspective<\/h2>\n
At CSB, we see PromptSpy as an early example of AI being used to make attacks more adaptable rather than more complex.<\/p>\n
While the current use case is limited, it demonstrates how AI can help malware overcome small technical barriers that once required manual refinement by attackers. Over time, this could lower the barrier to entry for less sophisticated threat actors.<\/p>\n
Organisations should consider this a reminder that mobile devices are no longer secondary endpoints \u2014 they are primary gateways to banking apps, corporate email, authentication systems, and cloud services.<\/p>\n
Practical steps for users and organisations include:<\/p>\n
\n
- \nOnly installing apps from official app stores\n<\/li>\n
- \nReviewing Accessibility permissions carefully\n<\/li>\n
- \nKeeping devices updated\n<\/li>\n
- \nEnsuring Google Play Protect or equivalent protections are enabled\n<\/li>\n
- \nUsing strong, phishing-resistant authentication methods where possible\n<\/li>\n<\/ul>\n
For businesses, mobile device management (MDM) and conditional access controls can significantly reduce the risk of compromised mobile devices accessing sensitive systems.<\/p>\n
AI-powered malware is not yet widespread in the mobile space. However, PromptSpy shows how attackers are experimenting with generative AI to increase automation and resilience.<\/p>\n
The key takeaway is not alarm, but awareness. AI is becoming part of the attacker toolkit \u2014 and defenders must continue evolving visibility, identity protection, and endpoint controls accordingly.<\/p>\n","protected":false},"excerpt":{"rendered":"
We recently reviewed new research from ESET, which has identified an Android malware family dubbed PromptSpy. According to ESET researcher Luk\u00e1\u0161 \u0160tefanko, this appears to be the first observed Android […]<\/p>\n","protected":false},"author":1,"featured_media":585,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[],"tags":[],"class_list":["post-586","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/posts\/586","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/comments?post=586"}],"version-history":[{"count":0,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/posts\/586\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/media\/585"}],"wp:attachment":[{"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/media?parent=586"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/categories?post=586"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/qld.cybersafebusiness.au\/index.php\/wp-json\/wp\/v2\/tags?post=586"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}