Executive Summary

In a significant development for mobile security, researchers at ESET have discovered PromptSpy, the first known Android malware to actively weaponize a generative AI model, Google Gemini, as part of its attack chain. The malware uses the AI to interpret a device's user interface (UI) and generate precise instructions for navigation, allowing it to achieve persistence by programmatically 'pinning' itself in the recent apps list. This novel technique makes the malware highly adaptable to various Android versions and device layouts, overcoming a major hurdle for developers of malicious software. The ultimate payload is a Virtual Network Computing (VNC) module that grants attackers remote control over the device. While currently limited in distribution and targeting users in Argentina, PromptSpy represents a proof-of-concept for a new class of dynamic, AI-powered malware.

Threat Overview

PromptSpy introduces a paradigm shift in malware design. Traditional Android malware that attempts UI manipulation relies on hardcoded coordinates or accessibility service abuse, which often fails across different device models, screen sizes, or OS versions. PromptSpy solves this problem with AI.

The malware's core innovation is its persistence mechanism. It operates as follows:

1. The malware captures an XML dump of the device's current screen layout.
2. It sends this XML data along with a natural language prompt (e.g., "How do I click the button to pin this app?") to the Gemini AI model via an API.
3. Gemini processes the UI structure and returns a JSON object with step-by-step instructions, including the exact coordinates to tap.
4. The malware executes these instructions, successfully navigating the UI to lock itself in the recent apps tray, making it difficult for a non-technical user to terminate.

After achieving persistence, PromptSpy's main objective is to enable remote access via a built-in VNC module, allowing attackers to spy on the user, steal data, and perform actions on their behalf. It also includes capabilities to capture lockscreen data and block uninstallation attempts.

Technical Analysis

PromptSpy's use of AI for UI interaction is a form of Automated Manipulation of Android's User Interface (T1418), but executed in a novel way.

• Execution - Command and Scripting Interpreter (T1059): The malware executes the JSON-formatted commands returned by the Gemini AI.
• Persistence - Modify System App (T1464): While not modifying a system app directly, the act of pinning itself in the recent apps list is a functional equivalent, achieving a form of user-level persistence that is difficult to reverse.
• Defense Evasion - Abuse of Accessibility Features (T1419): Although it uses AI instead of just accessibility services, the end goal of UI manipulation is the same. The AI makes the abuse far more reliable and scalable.
• Remote Access Software (T1219): The final payload is a VNC server, giving the attacker full remote control of the device's screen and input.

The weaponization of generative AI for dynamic execution marks a critical inflection point. Defenders can no longer rely on static signatures or predictable behavior. Malware can now adapt its behavior in real-time based on its environment, posing a significant challenge to traditional detection methods.

Impact Assessment

The immediate impact of PromptSpy is limited, as it appears to be a targeted or proof-of-concept campaign focused on Argentina (distributed via a fake JPMorgan Chase site). However, the long-term implications are profound.

• Increased Malware Resilience: AI-driven malware can adapt to new OS updates, security patches, and device layouts without needing to be rewritten, dramatically increasing its lifespan and effectiveness.
• Lowered Barrier to Entry: Attackers with less technical skill could leverage AI to create sophisticated, adaptable malware, potentially leading to a proliferation of such threats.
• Detection Challenges: Security software that relies on static analysis or predictable behavioral patterns will struggle to detect malware that generates its actions dynamically. This will force a shift towards more advanced, on-device behavioral monitoring and anomaly detection.

For an infected user, the impact is severe: complete loss of privacy and control over their device, leading to theft of banking credentials, personal messages, and any other data accessible on the phone.

Cyber Observables for Detection

Detection & Response

• Network Monitoring: On-device firewalls or Mobile Threat Defense (MTD) solutions should be configured to alert on unexpected applications making API calls to known generative AI endpoints like generativelanguage.googleapis.com. This is the most reliable indicator of this specific malware. Apply D3FEND Outbound Traffic Filtering (D3-OTF).
• Behavioral Analysis: MTD solutions must evolve to incorporate more sophisticated behavioral analysis. Instead of just looking for the use of accessibility services, they need to detect patterns of rapid, programmatic UI interaction that mimic human behavior but occur without physical input. D3FEND Process Analysis (D3-PA) is key.
• App Vetting: Only install applications from the official Google Play Store. The malware was distributed via a third-party website.

Mitigation

1. Restrict App Installation: Configure Android devices (via MDM for enterprises) to block the installation of apps from unknown sources. This is a fundamental security control (D3FEND Executable Denylisting (D3-EDL)).
2. Monitor Network Egress: For corporate-managed devices, monitor and restrict outbound network traffic. Block access to generative AI APIs for all applications except those explicitly authorized.
3. User Education: Train users to be wary of apps downloaded from outside official app stores and to be suspicious of any app that requests extensive permissions.
4. Google's Role: As the provider of both the OS and the AI model, Google is in a unique position to mitigate this threat. They could implement rate limiting, require API key authentication that can be tied to developer accounts, or use on-device analysis to detect when an app is using AI for malicious UI manipulation.