Threat reportMalwareTL-2026-0135
PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote Access, Chase Bank Impersonation
ESET researchers discovered PromptSpy, the first known Android malware to abuse generative AI (Google Gemini) in its execution flow. The malware sends Gemini natural-language prompts with XML dumps of the current screen to dynamically navigate UI and achieve persistence across any device, layout, or OS version.
Key facts
| Identifiers | TL-2026-0135 |
|---|---|
| Severity | HIGH |
| Nation-state nexus | China |
| Malware | PromptSpy |
| MITRE ATT&CK techniques | T1398 Boot or Logon Initialization Scripts, T1406.002 Obfuscated Files or Information: Software Packing, T1417.001 Input Capture: Keylogging, T1417.002 Input Capture: GUI Input Capture, T1418 Software Discovery, T1426 System Information Discovery, T1476 Deliver Malicious App via Other Means, T1512 Video Capture, T1513 Screen Capture, T1516 Input Injection, T1521.001 Encrypted Channel: Symmetric Cryptography, T1541 Foreground Persistence and 7 more in the attack flow |
| Motivation | FINANCIAL |
| Detection rules | 9 (1 shown free) |
Detection coverage
As of 2026-02-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0135 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: PromptSpy VNC Remote Access to C2, AES-Encrypted Exfiltration, and Anti-Removal Overlay Detection
Detects C2/persistence: VNC protocol connection (port 5900) from Android device to C2 54.67.2[.]84 (AWS EC2), AES-128-CBC encrypted data exfiltration over VNC channel (hardcoded key, zero IV), Gemini API key received from non-Google server, transparent TYPE_APPLICATION_OVERLAY on Uninstall/Force Stop buttons for anti-removal, Accessibility Service BACK button override preventing settings access, and RECEIVE_BOOT_COMPLETED auto-restart persistence.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1663, T1521.001, T1646, T1629.001, T1398, T1418
- Data sources: firewall_logs, mtd_logs, network_flow_logs
- Severity: critical
- Confidence: high
Splunk SPL
index=firewall sourcetype="firewall_logs"
| search (
(dest_ip="54.67.2.84" dest_port=5900)
OR (dest_port=5900 src_device_type="mobile")
)
| eval alert_type="vnc_c2_connection"
| append [
search index=mobile sourcetype="mtd_logs" event_type="overlay"
overlay_type="TYPE_APPLICATION_OVERLAY"
(overlay_target_text="*Uninstall*" OR overlay_target_text="*Force stop*" OR overlay_target_text="*Disable*")
| eval alert_type="anti_removal_overlay"
]
| append [
search index=mobile sourcetype="mtd_logs" event_type="boot_receiver"
action="RECEIVE_BOOT_COMPLETED"
NOT app_package IN ("com.google.*", "com.samsung.*", "com.android.*")
| eval alert_type="boot_persistence"
]
| table _time, device_id, src_ip, dest_ip, dest_port, alert_type, app_packageMicrosoft KQL
let vnc = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == 5900
| extend AlertType = "vnc_c2_connection";
let vnc_ioc = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP == "54.67.2.84"
| extend AlertType = "promptspy_c2_ioc";
let overlay = SecurityAlert
| where Timestamp > ago(24h)
| where AlertName has_any ("overlay_blocking", "anti_removal", "system_alert_window_abuse")
| extend AlertType = "anti_removal_overlay";
let boot = SecurityAlert
| where Timestamp > ago(24h)
| where AlertName has_any ("boot_persistence", "boot_completed_receiver", "auto_start")
| extend AlertType = "boot_persistence";
let app_enum = SecurityAlert
| where Timestamp > ago(24h)
| where AlertName has_any ("app_enumeration", "package_scan", "installed_apps_exfil")
| extend AlertType = "installed_app_reconnaissance";
union vnc, vnc_ioc, overlay, boot, app_enum
| project Timestamp, DeviceName, AlertType, RemoteIP, RemotePort, AlertName
| sort by Timestamp descSigma
title: VNC Connection from Mobile Device to Known PromptSpy C2 (54.67.2.84:5900)
id: f0f6327d-71df-41f7-ad90-f08351e97769
status: experimental
description: Detects VNC protocol connection (port 5900) from Android device to PromptSpy C2 server. Also covers anti-removal overlay on system buttons and boot persistence.
references:
- https://www.welivesecurity.com/en/eset-research/promptspy-first-android-genai-malware/
author: Threadlinqs Team
date: 2026/02/23
tags:
- attack.command_and_control
- attack.t1663
- attack.t1521.001
- attack.t1646
logsource:
category: firewall
detection:
selection_ioc:
dst.ip: '54.67.2.84'
dst.port: 5900
selection_vnc:
dst.port: 5900
src.device_type: 'mobile'
condition: selection_ioc or selection_vnc
falsepositives:
- Legitimate VNC remote support from mobile device (rare)
- IT helpdesk using VNC from mobile to manage servers
level: criticalKnown false positives:
- Legitimate VNC remote support from mobile device (rare)
- IT helpdesk VNC from mobile to servers
Tuning notes: VNC (port 5900) from mobile device is always suspicious. 54.67.2[.]84 is definitive PromptSpy IOC. Anti-removal overlay detection requires MTD with overlay monitoring capability.
- PromptSpy Multi-Signal Detection: Gemini API Abuse, Dropper Sideloading, and Chase Phishing Correlation · unlock with TL Creds
- Mobile Threat Defense Alert Correlation for PromptSpy Banking Credential Theft and Screen Surveillance · unlock with TL Creds
- PromptSpy Anti-Removal Overlay, VNC Data Exfiltration, and Banking App Reconnaissance Detection · unlock with TL Creds
- Accessibility Service Sending Screen XML to Gemini API for AI-Directed UI Manipulation · unlock with TL Creds
- MediaProjection Screen Recording Triggered by Banking App Foreground Detection · unlock with TL Creds
- PromptSpy Network IOC Detection: Chase Phishing Domain, Dropper Distribution, and C2 Infrastructure · unlock with TL Creds
- PromptSpy Dropper Distribution, Chase Bank Phishing, and Gemini AI UI Manipulation Detection · unlock with TL Creds
- PromptSpy Banking Credential Keylogging, Lockscreen PIN Capture, and Screen Recording Exfiltration · unlock with TL Creds
Indicators of compromise
As of 2026-02-23, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-0135.
Sample indicators (3 of 20)
- IP address:
54.67.2[.]84 - Domain:
m-mgarg[.]com - File hash:
6BBC9AB132BA066F63676E05DA13D108598BC29B
Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.
Technical analysis
Its primary payload deploys a VNC module for full remote device access with AES-encrypted C2 communication.
PromptSpy represents a paradigm shift in mobile malware — the first Android threat to incorporate generative AI (Google Gemini) directly into its execution flow. Discovered by ESET in February 2026, this malware family demonstrates how attackers can leverage large language models to create adaptive, device-agnostic malware that breaks free from the limitations of hardcoded UI automation scripts.
The malware operates as a two-stage dropper architecture. The PromptSpy dropper (distributed via mgardownload[.]com) installs the core payload (app-release.apk) which contains the malicious VNC and AI capabilities. Upon installation, the dropper displays a fake Chase Bank (JPMorgan Chase N.A.) website hosted on m-mgarg[.]com, branded as "MorganArg" — likely targeting Argentine users with a financial services lure.
The AI-powered component works through a continuous feedback loop: PromptSpy uses Accessibility Services to open the Recent Apps screen and collects a detailed XML dump of all visible UI elements including text, content descriptions, class names, package names, and screen bounds. This XML snapshot is sent to Google's Gemini API along with hardcoded natural-language prompts instructing the AI to analyze the UI and return JSON-formatted step-by-step instructions for performing the "lock app in recent apps" gesture. The malware executes these instructions via Accessibility Services, sends the updated screen state back to Gemini, and continues until Gemini confirms the app is successfully locked. This AI-driven approach replaces traditional hardcoded tap coordinates and UI selectors, making the malware resilient to UI changes across different devices, manufacturers, and Android versions.
The primary malicious capability is a built-in VNC module that gives operators full remote access to compromised devices — real-time screen viewing and complete device control including taps, swipes, gestures, and text input. C2 communication uses the VNC protocol over a hardcoded server (54.67.2[.]84) with AES encryption using a hardcoded key. Through this channel, the malware receives Gemini API keys, uploads installed app lists, intercepts lockscreen PINs/passwords, captures pattern unlock screens as video recordings, reports screen state and foreground apps, records screen activity for server-specified apps, and takes screenshots on demand.
Anti-removal capabilities exploit Accessibility Services to overlay transparent rectangles on screen areas containing buttons with substrings like "stop", "end", "clear", and "Uninstall" — invisible to users but intercepting all touch interactions on those elements. The only removal method is rebooting into Safe Mode where third-party apps are disabled.
The predecessor VNCSpy appeared on VirusTotal on January 13, 2026 (uploaded from Hong Kong) with three samples. Four PromptSpy dropper samples appeared on February 10, 2026 from Argentina. A companion phishing app (Android/Phishing.Agent.M) shares the same distribution domain, app name, icon, and developer certificate, likely serving as an initial stage leading victims to install PromptSpy.
Development artifacts include debug strings in simplified Chinese and handling for Chinese Accessibility event types, suggesting development in a Chinese-speaking environment. ESET classifies this with medium confidence. This is ESET's second AI-powered malware discovery after PromptLock ransomware (August 2025), the first known case of AI-driven ransomware.
PromptSpy has not been observed in ESET telemetry yet, possibly indicating proof-of-concept status, but the existence of distribution domains and companion apps suggests active development toward deployment. Android users with Google Play Protect enabled are automatically protected against known versions.
MITRE ATT&CK techniques by tactic:
Persistence
T1398 Boot or Logon Initialization Scripts; T1541 Foreground Persistence
Defense Evasion
T1406.002 Obfuscated Files or Information: Software Packing; T1516 Input Injection; T1629.001 Impair Defenses: Prevent Application Removal; T1655 Masquerading
Credential Access
T1417.001 Input Capture: Keylogging; T1417.002 Input Capture: GUI Input Capture
discovery
Discovery
T1426 System Information Discovery
Initial Access
T1476 Deliver Malicious App via Other Means; T1660 Phishing
Collection
T1512 Video Capture; T1513 Screen Capture; T1636 Protected User Data
Command and Control
T1521.001 Encrypted Channel: Symmetric Cryptography; T1663 Remote Access Software
Execution
Exfiltration
Timeline
- ESET discovers PromptLock, the first known AI-powered ransomware — predecessor in ESET's AI malware research series.
- Dr.WEB discovers Android.Phantom using TensorFlow ML models for ad fraud — prior art for ML in Android malware (not GenAI).
- Phishing domain locked-ioc-14 first seen, hosted on Amazon AWS (locked-ioc-12). Impersonates Chase Bank for Argentine users.
- Three VNCSpy samples (predecessor to PromptSpy) uploaded to VirusTotal from Hong Kong. Distribution domain locked-ioc-10 registered on Cloudflare.
- Four PromptSpy dropper samples uploaded to VirusTotal from Argentina. Contains embedded locked-ioc-11 payload with Gemini AI integration.
- Google Play Protect updated to detect known PromptSpy variants. ESET shared findings with Google via App Defense Alliance partnership.
- ESET publishes full technical analysis on WeLiveSecurity. IOCs released on GitHub. Source: https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/
- Threadlinqs Intelligence Platform publishes TL-2026-0135 with full MITRE mapping, detections, and simulations.
- As of 2026-05-29, PromptSpy remains an ESET-assessed proof-of-concept never seen in telemetry, off Google Play, and now flagged by Play Protect with Google having disabled linked assets and hardening the Gemini API. No CVE, no in-the-wild campaign, takedown, or successor has emerged since the Feb-2026 disclosure, so it stays under monitoring rather than active.
Previous and next in malware
Drafted by the Threadlinqs research pipeline; published ; last updated —.
