PROMPTSPY: Android Malware Using Gemini API for Runtime UI Automation (2026)

Incident Summary

In February 2026, ESET Research disclosed PROMPTSPY, an Android backdoor that researchers describe as the first documented mobile malware to call a generative AI service during its execution flow.^[1] The malware contained a component ESET identifies as a GeminiAutomationAgent, which serialized the current Android UI hierarchy as XML and queried the Gemini-2.5-flash-lite API to generate touch commands at runtime.^[2]

PROMPTSPY used Android accessibility permissions and an external Gemini API call to generate UI-interaction commands at runtime. Public reporting describes capabilities including a built-in VNC module for remote operator access, interception of lockscreen PIN and password entry, video capture of the pattern-unlock screen, on-demand screenshots, and screen and gesture recording. ESET describes the accessibility abuse specifically as an anti-removal mechanism: when a user tries to uninstall the payload or disable Accessibility Services, the malware overlays transparent rectangles on parts of the screen.^[1][2]

ESET stated that it had not observed PROMPTSPY in its telemetry, which it noted “might indicate that both of them are just proofs of concept,” and assessed from language-localization clues and observed distribution vectors that the campaign appears financially motivated and aimed primarily at users in Argentina.^[2] Confirmed victim impact therefore remains unestablished. On May 11, 2026, the Google Threat Intelligence Group reported that it had disabled the assets associated with this activity and that, based on its detection, no apps containing PROMPTSPY were found on Google Play, with Google Play Protect covering known versions.^[3]

Key Facts

• First-of-kind: First publicly documented Android malware to invoke a commercial generative AI API during execution
• AI used: Google Gemini-2.5-flash-lite via the Gemini API
• Capabilities: Runtime UI automation, lockscreen PIN/password interception, pattern-unlock video capture, screenshots and gesture recording, anti-removal accessibility overlays, VNC remote access
• Apparent target: Users in Argentina, inferred by ESET from language-localization clues and distribution vectors
• Confirmed victim impact: None publicly established — ESET reported it had not observed PROMPTSPY in its telemetry
• Distribution: No apps containing PROMPTSPY found on Google Play (per Google)
• Vendor response: ESET published full IoCs and MITRE ATT&CK mapping; Google disabled the associated Gemini API assets
• Status: Assessed by ESET as a possible proof of concept

Threat Patterns Involved

Primary: AI-Morphed Malware — The defining characteristic is that PROMPTSPY’s runtime behavior is generated by an external AI model rather than compiled into the binary. The GeminiAutomationAgent serializes the live UI and asks Gemini what to do next, so the malware adapts per device and per screen without shipping that logic.

Secondary:

• Tool Misuse & Privilege Escalation — An LLM-driven loop abuses Android accessibility privileges, granted for assistive use, to act on the device beyond its authorized scope.
• Adversarial Evasion — Generating per-victim automation at runtime frustrates static signature and behavioral heuristics that assume malware logic is fixed in the binary.

Significance

PROMPTSPY is the first publicly documented case of mobile malware outsourcing decision logic to a commercial generative AI service in real time. It matters for several reasons:

1. Cloud-LLM-driven malware: The behavior is not in the binary. Static analysis of the APK reveals scaffolding, but the actual exploitation logic is produced on demand by a third-party LLM.
2. Provider-side disruption adds leverage: Google disabling the associated API assets removed the component that generated behavior at runtime. This is a complementary and potentially high-leverage takedown path alongside endpoint controls, which can still detect accessibility-permission abuse, overlays, VNC behavior, anomalous network traffic, and known APK indicators.
3. Abuse of accessibility services persists: A long-standing Android attack pattern is now being driven by an autonomous agent loop rather than a fixed automation script.
4. A capability signal, not a documented campaign: ESET’s framing, and the absence of telemetry hits, place this as an early demonstration rather than an operational campaign. The case signals a pattern defenders should expect to monitor across platforms: an external model supplying malware’s decision logic at runtime.