PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote Access, Chase Bank Impersonation — Threadlinqs Intelligence
As of 2026-05-30, PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote Access, Chase Bank Impersonation is a high-severity malware threat attributed to a China (medium confidence)-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0135 · Severity: HIGH · Status: MONITORING · Category: MALWARE
Attribution: China (medium confidence) · FINANCIAL
ESET researchers discovered PromptSpy, the first known Android malware to abuse generative AI (Google Gemini) in its execution flow. The malware sends Gemini natural-language prompts with XML dumps of
PromptSpy represents a paradigm shift in mobile malware — the first Android threat to incorporate generative AI (Google Gemini) directly into its execution flow. Discovered by ESET in February 2026, this malware family demonstrates how attackers can leverage large language models to create adaptive, device-agnostic malware that breaks free from the limitations of hardcoded UI automation scripts.
The malware operates as a two-stage dropper architecture. The PromptSpy dropper (distributed via mgardownload[.]com) installs the core payload (app-release.apk) which contains the malicious VNC and AI capabilities. Upon installation, the dropper displays a fake Chase Bank (JPMorgan Chase N.A.) website hosted on m-mgarg[.]com, branded as "MorganArg" — likely targeting Argentine users with a financial services lure.
The AI-powered component works through a continuous feedback loop: PromptSpy uses Accessibility Services to open the Recent Apps screen and collects a detailed XML dump of all visible UI elements including text, content descriptions, class names, package names, and screen bounds. This XML snapshot is sent to Google's Gemini API along with hardcoded natural-language prompts instructing the AI to analyze the UI and return JSON-formatted step-by-step instructions for performing the "lock app in recent apps" gesture. The malware executes these instructions via Accessibility Services, sends the updated screen state back to Gemini, and continues until Gemini confirms the app is successfully locked. This AI-driven approach replaces traditional hardcoded tap coordinates and UI selectors, making the malware resilient to UI changes across different devices, manufacturers, and Android versions.
The primary malicious capability is a built-in VNC module that gives operators full remote access to compromised devices — real-time screen viewing and complete device control including taps, swipes, gestures, and text input. C2 communication uses the VNC protocol over a hardcoded server (54.67.2[.]84) with AES encryption using a hardcoded key. Through this channel, the malware receives Gemini API keys, uploads installed app lists, intercepts lockscreen PINs/passwords, captures pattern unlock screens as video recordings, reports screen state and foreground apps, records screen activity for server-specified apps, and takes screenshots on demand.
Anti-removal capabilities exploit Accessibility Services to overlay transparent rectangles on screen areas containing buttons with substrings like "stop", "end", "clear", and "Uninstall" — invisible to users but intercepting all touch interactions on those elements. The only removal method is rebooting into Safe Mode where third-party apps are disabled.
The predecessor VNCSpy appeared on VirusTotal on January 13, 2026 (uploaded from Hong Kong) with three samples. Four PromptSpy dropper samples appeared on February 10, 2026 from Argentina. A companion phishing app (Android/Phishing.Agent.M) shares the same distribution domain, app name, icon, and developer certificate, likely serving as an initial stage leading victims to install PromptSpy.
Development artifacts include debug strings in simplified Chinese and handling for Chinese Accessibility event types, suggesting development in a Chinese-speaking environment. ESET classifies this with medium confidence. This is ESET's second AI-powered malware discovery after PromptLock ransomware (August 2025), the first known case of AI-driven ransomware.
PromptSpy has not been observed in ESET telemetry yet, possibly indicating proof-of-concept status, but the existence of distribution domains and companion apps suggests active development toward deployment. Android users with Google Play Protect enabled are automatically protected against known versions.
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1398, T1541, T1516, T1417.002, T1426, T1418, T1513, T1663, T1521.001, T1646