Android Malware Taps Google Gemini at Runtime

A newly discovered Android malware strain is using Google’s Gemini generative artificial intelligence model to automate part of its persistence mechanism, marking what researchers describe as the second known case of AI-driven mobile malware.

See Also: The Healthcare CISO’s Guide to Medical IoT Security

Security firm Eset dubbed the malware “PromptSpy,” describing it as an early example of GenAI being embedded directly into operational Android malware to adapt to device environments and resist removal.

Researchers identified the malware in Android app packages uploaded to VirusTotal. Eset said it has not detected PromptSpy in product telemetry, and widespread in-the-wild deployment has not been confirmed. But the technical design shows how threat actors are experimenting with AI models to overcome traditional limitations in mobile malware automation.

The discovery follows Eset’s August 2025 disclosure of “PromptLock,” a GenAI-driven ransomware strain that embedded a locally hosted large language model to dynamically generate encryption routines and support malicious code at runtime rather than relying on fully precompiled binaries.

PromptSpy’s key innovation centers on how it interacts with the Android user interface. Instead of relying on hard-coded screen coordinates or static automation scripts, which often fail, the malware captures an XML dump of the user’s active screen, including text labels, class types and on-screen coordinates. It sends this structured data to Gemini.

The model returns JSON-formatted instructions identifying which interface elements to tap or manipulate. PromptSpy executes those actions locally, retrieves the updated screen state and repeats the process until it achieves persistence.

After installation, the malware attempts to obtain AccessibilityService permissions, a high-risk Android feature that almost every Android Trojan ever coded attempts to fool users into authorizing (see: Massiv Attack: Android Trojan Targets IPTV Users).

Researchers say the malware includes removal prevention features. It overlays invisible interface elements over buttons containing substrings such as “stop,” “end,” “clear” or “Uninstall,” intercepting user interaction and blocking standard removal attempts. The only reliable removal method is rebooting the device into safe mode, where third-party apps cannot interfere. Other observed capabilities include collecting device information, uploading lists of installed applications, capturing lock screen PINs, recording unlock patterns as video, reporting foreground app status and capturing screenshots.

Eset traced PromptSpy samples to a standalone website impersonating JPMorgan Chase under the name MorganArg, suggesting the campaign is targeting Argentine users. Researchers also observed Chinese-language strings within the codebase, indicating possible development ties to a Chinese-speaking environment. It did not attribute the activity to a known threat group.