Loading malware…
PromptSpy is an Android malware family best characterized as a backdoor with spyware and remote-access functionality. It is notable as the first publicly reported mobile malware known to invoke a generative AI model during runtime on a victim device. PromptSpy integrates Google Gemini into its execution flow to interpret visible Android user-interface elements and generate gesture instructions, allowing the malware to navigate screens dynamically rather than relying solely on hardcoded logic. It uses Android accessibility services to execute those AI-derived actions, including clicks and swipes, enabling autonomous interaction with the device UI.
PromptSpy supports live remote control of infected devices and can collect sensitive information from them. Reported capabilities include capturing lockscreen PINs and passwords, enumerating installed applications, taking screenshots, recording video, and enabling live screen control over encrypted communications. It has also been reported to capture authentication artifacts sufficient to replay PIN or lock-pattern style authentication and regain access to a compromised device for follow-on activity.
Persistence and anti-removal are central to its design. PromptSpy uses accessibility-driven UI automation to keep itself pinned in the recent apps list and employs deceptive anti-uninstall measures by placing invisible overlays over Android interface elements associated with stopping or uninstalling the app, causing user taps to be intercepted and making removal appear ineffective. Additional resilience has been reported through remote updating of operational components, including Gemini-related configuration and relay infrastructure, without redeploying the payload. Firebase Cloud Messaging has also been cited as a mechanism used to relaunch the malware when a device becomes inactive.
PromptSpy was discovered in 2026 and has been described as an early-stage or limited-deployment threat rather than a broadly observed campaign. Distribution has been linked to a fake banking-themed Android application impersonating an Argentine financial brand. Researchers have noted indications consistent with a Chinese-speaking development environment, but public reporting has not established a definitive attribution to a known threat actor. Google stated that no PromptSpy-infected apps were identified on Google Play and that known versions are detected by Google Play Protect.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Instead of hardcoding taps for every possible screen layout, PromptSpy sends Gemini a plain language request along with a full map of everything visible on the current screen... Gemini studies that data and sends back a set of instructions describing which gestures to perform and where.
If the victim device becomes inactive, PROMPTSPY operators can utilize Firebase Cloud Messaging (FCM) to relaunch the backdoor, allowing the threat actor to continue their intrusion activity without alerting the victim.
PromptSpy carries out those actions through Android’s accessibility tools, then checks the updated screen and repeats the process until the app is confirmed locked in place.
If the victim device becomes inactive, PROMPTSPY operators can utilize Firebase Cloud Messaging (FCM) to relaunch the backdoor, allowing the threat actor to continue their intrusion activity without alerting the victim.
If the victim tries to uninstall PROMPTSPY, the malware employs its 'AppProtectionDetector' module to identify the on-screen coordinates of the 'Uninstall' button. The malware renders an invisible overlay directly over the button as a shield that silently intercepts and consumes the victim's touch events, making the button appear unresponsive to the user.
Their analysis found that the malware was distributed through a website designed to look like the Argentine branch of a major banking brand, complete with a matching app name meant to build trust with targets.
It abuses accessibility permissions to place invisible overlays directly on top of the Stop and Uninstall buttons in the app settings menu, so tapping them does nothing.
Promptspy used the Gemini API as an Android backdoor to analyze UI structure and simulate clicks, swipes, and even included a delete sabotage feature.
PROMPTSPY embeds a module called GeminiAutomationAgent that sends a serialized XML representation of the victim device’s current UI hierarchy... and parses the model’s structured JSON response into specific touch coordinates and gesture commands.
PROMPTSPY embeds a module called GeminiAutomationAgent that sends a serialized XML representation of the victim device’s current UI hierarchy... and parses the model’s structured JSON response into specific touch coordinates and gesture commands.
Later research from Google’s Threat Intelligence Group added that PromptSpy’s AI component was built with broader screen navigation goals in mind, and that attackers can update pieces of the malware, including its Gemini API keys, remotely through its command and control channel.
Promptflux : A self-morphing dropper that calls the Gemini API to periodically rewrite its own source code
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android backdoor that uses the Gemini API to navigate autonomously.
Android spyware / remote access trojan that steals information from infected phones, captures lockscreen PINs and passwords, lists installed apps, takes screenshots, records video, provides live screen control, uses Android accessibility services for persistence and anti-removal, and queries Google Gemini in real time to determine screen interactions.
Android spyware / remote access trojan that steals information from infected phones, including lockscreen PINs and passwords, lists installed apps, captures screenshots, records video, provides live screen control, uses Android accessibility features for persistence and uninstall resistance, and queries Google Gemini at runtime to adapt screen interactions dynamically.
Android malware that uses generative AI, specifically Google's Gemini, to interpret user interface elements and adapt across devices and environments without relying on hardcoded behavior.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.