ESET researchers have discovered PromptSpy, the first Android malware to integrate GenAI into its execution logic.

ESET researchers have discovered PromptSpy, the first Android malware to integrate GenAI into its execution logic. Unlike traditional scripted malware, PromptSpy uses Google’s Gemini to interpret on-screen elements and generate dynamic instructions. Specifically, it leverages AI to guide UI gestures that keep the malicious app pinned in the recent apps list. This adaptive persistence technique prevents easy termination and increases survivability across diverse Android versions and device layouts.

Android malware typically relies on hardcoded UI navigation scripts. However, interface variations across manufacturers often break static logic. Because of this, PromptSpy overcomes this fragmentation challenge by outsourcing interpretation to a generative model. Gemini analyzes the device screen and provides step-by-step instructions to execute the correct gesture. Although AI supports only the persistence layer, it significantly increases adaptability. This marks a shift from static exploitation toward AI-assisted operational flexibility.

Beyond AI integration, PromptSpy deploys a built-in VNC module to enable remote device control. It captures lockscreen data, records screen activity, blocks uninstallation through Accessibility Service abuse, and encrypts communication with command servers. The AI component enhances automation rather than replacing core payload functions. By automating UI manipulation, attackers expand the pool of potential victims without rewriting code for each device configuration.

Why it matters
GenAI is entering the offensive cybersecurity landscape.
• AI-driven UI interpretation increases malware adaptability across fragmented ecosystems
• Automation reduces development overhead for threat actors
• Security defenses must now anticipate AI-assisted persistence techniques

This case reflects a broader enterprise cybersecurity challenge. As generative AI becomes embedded in consumer platforms, attackers can exploit the same models to automate evasion. Enterprises must prepare for AI-augmented threats that adapt dynamically instead of relying on static scripts. PromptSpy signals the transition from experimental AI misuse to operational AI weaponization. Defensive architectures must evolve accordingly.