PromptSpy
PROMPTSPY is an Android backdoor first surfaced by ESET and described as a novel malware family that abuses Google Gemini APIs and Android accessibility/UI features to automate interaction with infected devices. Reported capabilities include analyzing the device UI structure, including sending a serialized XML representation of the visible UI hierarchy via a GeminiAutomationAgent component to the gemini-2.5-flash-lite model, parsing structured JSON responses into touch coordinates and gesture commands, and simulating clicks and swipes to autonomously manipulate the interface. The malware has been reported to gather device information, take screenshots, record screen activity as video, and capture lockscreen or authentication data, including PINs or lock patterns, to replay authentication gestures and regain access to a compromised device for follow-on exploitation. For persistence and anti-removal, PROMPTSPY uses a multi-layered defense mechanism that includes an AppProtectionDetector module to identify the on-screen Uninstall button and place an invisible overlay over it to intercept touch events, making removal appear unresponsive; it has also been reported to use Firebase Cloud Messaging to relaunch when the device becomes inactive and to keep itself pinned in the recent apps list. The malware initializes with hardcoded infrastructure and credentials but supports runtime rotation of critical components, including command-and-control infrastructure, Gemini API keys, and a VNC relay server, without redeploying the payload. Google reportedly disabled assets associated with the activity, stated that no apps containing PROMPTSPY were found on Google Play, and said Google Play Protect detects known versions. The content attributes discovery to ESET; no specific threat actor, infection vector, or targeted industry is stated with confidence in the provided material.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Resource Development
1 technique
Resource Development
Initial Access
3 techniques
Initial Access
If the victim device becomes inactive, PROMPTSPY operators can utilize Firebase Cloud Messaging (FCM) to relaunch the backdoor, allowing the threat actor to continue their intrusion activity without alerting the victim.
Execution
3 techniques
Execution
“AI-enabled malware, such as PROMPTSPY, signal a shift toward autonomous attack orchestration, where models interpret system states to dynamically generate commands and manipulate victim environments.”
Persistence
3 techniques
Persistence
If the victim device becomes inactive, PROMPTSPY operators can utilize Firebase Cloud Messaging (FCM) to relaunch the backdoor, allowing the threat actor to continue their intrusion activity without alerting the victim.
Privilege Escalation
3 techniques
Privilege Escalation
GTIG also highlighted PROMPTSPY ... that abuses the Gemini API and accessibility features to interact with the Android user interface (UI) in an automated fashion.
If the victim device becomes inactive, PROMPTSPY operators can utilize Firebase Cloud Messaging (FCM) to relaunch the backdoor, allowing the threat actor to continue their intrusion activity without alerting the victim.
If the victim tries to uninstall PROMPTSPY, the malware employs its 'AppProtectionDetector' module to identify the on-screen coordinates of the 'Uninstall' button. The malware renders an invisible overlay directly over the button as a shield that silently intercepts and consumes the victim's touch events, making the button appear unresponsive to the user.
Stealth
4 techniques
Stealth
According to the researchers, the role of the prompt is to assign a benign persona so it can bypass the LLM's safety features.
it intercepts uninstall attempts by rendering an invisible overlay over the uninstall button to silently consume touch events.
Credential Access
4 techniques
Credential Access
PROMPTSPY embeds a module called GeminiAutomationAgent that sends a serialized XML representation of the victim device’s current UI hierarchy... and parses the model’s structured JSON response into specific touch coordinates and gesture commands.
placing a transparent overlay over the “delete” button to intercept touch events when the victim tries to delete the app
Discovery
1 technique
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
4 techniques
Collection
PROMPTSPY embeds a module called GeminiAutomationAgent that sends a serialized XML representation of the victim device’s current UI hierarchy... and parses the model’s structured JSON response into specific touch coordinates and gesture commands.
placing a transparent overlay over the “delete” button to intercept touch events when the victim tries to delete the app
“PromptSpy submits a natural language prompt to Gemini, together with an XML dump of the device's current screen, and the chatbot returns JSON instructions for what action to perform and where to perform it…”
The malware contains an autonomous module that maps the visible layout of a device's screen, sends that layout to Gemini and receives back precise coordinates and gesture instructions like clicks and swipes that it then executes to navigate the phone on the attacker's behalf.
Command and Control
5 techniques
Command and Control
If the victim device becomes inactive, PROMPTSPY operators can utilize Firebase Cloud Messaging (FCM) to relaunch the backdoor, allowing the threat actor to continue their intrusion activity without alerting the victim.
Promptflux : A self-morphing dropper that calls the Gemini API to periodically rewrite its own source code
PROMPTSPY, an Android backdoor... sends a serialized XML representation of the victim device’s current UI hierarchy to the gemini-2.5-flash-lite model... and parses the model’s structured JSON response into specific touch coordinates and gesture commands
Impact
1 technique
Impact
Recent activity
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Android backdoor that uses a GeminiAutomationAgent module to send serialized UI hierarchy data to gemini-2.5-flash-lite, parse structured responses into touch and gesture commands, capture biometric replay artifacts, and block uninstall attempts via invisible overlays.
An Android backdoor that uses a GeminiAutomationAgent module to send serialized UI state to a Gemini model, receive structured action instructions, and autonomously interact with the device. It can also capture biometric replay artifacts and block uninstall attempts via an invisible overlay.
Android backdoor that uses the Gemini API to analyze UI structure and simulate gestures for autonomous device interaction, including preventing app deletion via a transparent overlay.
Android malware that integrates with Gemini APIs to automate interactions on infected devices and appears capable of replaying authentication methods, including PINs and lock patterns, using AI-assisted techniques.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.