ESET Report: Thousands of Malicious AI Skills Found Abusing AI Agents for Data Theft and Code Execution

Executive Summary

The rapid expansion of the Artificial Intelligence (AI) agent ecosystem has introduced a novel and dangerous attack surface. A new report from ESET reveals that threat actors are actively creating and distributing malicious AI 'skills' to compromise users and systems. In an analysis of nearly 900,000 skills, ESET identified over 3,000 as overtly malicious and another 25,000 as suspicious. These skills, which extend the functionality of AI agents, are being weaponized to steal data, execute malware, and inject malicious code. The report also details the discovery of PromptSpy, the first Android malware observed using a generative AI model (Google's Gemini) to enhance its capabilities, signaling a new trend in mobile threats.

Threat Overview

• Attack Surface: The growing marketplace of AI 'skills' for AI agents.
• Threat: Malicious skills designed to abuse the permissions and context of AI agents.
• Scale: Over 3,000 malicious and 25,000 suspicious skills discovered between March and May 2026.
• Malicious Capabilities: Researchers found skills capable of:
  • Command execution
  • File access and exfiltration
  • Credential loading and theft
  • Code injection and obfuscation
• Emerging Malware: The report highlights PromptSpy, an Android malware that uses Google's Gemini AI to achieve its objectives.

Technical Analysis

Malicious AI Skills

AI agents (like those from OpenAI, Google, etc.) can have their functionality extended by third-party 'skills' or 'plugins.' Threat actors are creating skills that appear legitimate but contain hidden malicious functionality. When a user enables a malicious skill, they grant it permissions that the attacker can then abuse. For example:

• A skill that promises to 'summarize your documents' could use its file access permission to secretly exfiltrate all documents it is given access to.
• A skill that 'integrates with your calendar' could steal authentication tokens for the user's account.
• A skill with 'command execution' capabilities could be used to download and run malware on the user's machine. This is a form of supply chain attack targeting the AI ecosystem, where trust in a skill's advertised function is exploited (T1195.001 - Compromise Software Supply Chain).

PromptSpy Android Malware

PromptSpy represents a significant evolution in mobile malware. It is the first known Android trojan to incorporate generative AI into its core operations. It uses Google Gemini to:

1. Interpret Screen Content: PromptSpy takes screenshots of the user's device.
2. AI Analysis: It sends these screenshots to the Gemini model with a prompt asking it to interpret what is on the screen and suggest actions.
3. Maintain Persistence: The AI's output is used to generate gestures (taps, swipes) that allow the malware to navigate menus, dismiss warnings, and grant itself additional permissions to ensure it remains active on the device. Its capabilities include intercepting lock-screen PINs, capturing screen activity, exfiltrating data from other apps, and providing full remote access to the attacker.

Impact Assessment

• New Attack Vector: The proliferation of malicious skills creates a new and difficult-to-defend attack vector. Users may not have the technical knowledge to vet the safety of an AI skill before enabling it.
• Sophisticated Mobile Malware: The use of AI in malware like PromptSpy can make it more resilient and harder to detect, as it can adapt its behavior based on the on-screen context.
• Data Privacy Risk: Malicious skills pose a massive data privacy risk, as they can be granted access to emails, documents, calendars, and other sensitive personal and corporate data.

IOCs — Directly from Articles

No specific Indicators of Compromise were provided in the source articles.

Cyber Observables — Hunting Hints

Detection & Response

1. Audit AI Skills: Organizations must establish policies for the use of AI agents and skills. Maintain an allowlist of vetted, approved skills. Security teams should periodically review skills enabled by users.
2. Mobile Threat Defense (MTD): Deploy MTD solutions on Android devices to detect malware like PromptSpy. These tools can identify applications that abuse accessibility services or exhibit other malicious behaviors.
3. Data Loss Prevention (DLP): Use DLP tools to monitor and block the exfiltration of sensitive data, which could be triggered by a malicious AI skill.

Mitigation

1. User Training and Awareness: Educate users about the risks of enabling third-party AI skills. Teach them to be cautious and only use skills from reputable, verified developers. Reference MITRE M1017 - User Training.
2. Principle of Least Privilege: When enabling any AI skill, users should grant it the absolute minimum permissions necessary for it to function. If a skill's requested permissions seem excessive for its stated purpose, it should not be trusted.
3. Restrict AI Agent Usage: In high-security environments, consider restricting or banning the use of AI agents with third-party skill marketplaces until better security vetting processes are in place. Reference MITRE M1033 - Limit Software Installation.