# PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote Access, Chase Bank Impersonation

> ESET researchers discovered PromptSpy, the first known Android malware to abuse generative AI (Google Gemini) in its execution flow. The malware sends Gemini natural-language prompts with XML dumps of the current screen to dynamically navigate UI and achieve persistence across any device, layout, or OS version. Its primary payload deploys a VNC module for full remote device access with AES-encrypted C2 communication.

- **Published:** 2026-02-23T17:57:00Z
- **Last reviewed:** 2026-02-23T17:57:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0135
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-promptspy-gemini-android-malware-tl-2026-0135.webp?v=3604ef09 (Threadlinqs threat intel: PromptSpy Android VNC Remote Access: Detection & IOCs (TL-2026-0135) — High severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-0135
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

PromptSpy represents a paradigm shift in mobile malware — the first Android threat to incorporate generative AI (Google Gemini) directly into its execution flow. Discovered by ESET in February 2026, this malware family demonstrates how attackers can leverage large language models to create adaptive, device-agnostic malware that breaks free from the limitations of hardcoded UI automation scripts.

The malware operates as a two-stage dropper architecture. The PromptSpy dropper (distributed via mgardownload[.]com) installs the core payload (app-release.apk) which contains the malicious VNC and AI capabilities. Upon installation, the dropper displays a fake Chase Bank (JPMorgan Chase N.A.) website hosted on m-mgarg[.]com, branded as "MorganArg" — likely targeting Argentine users with a financial services lure.

The AI-powered component works through a continuous feedback loop: PromptSpy uses Accessibility Services to open the Recent Apps screen and collects a detailed XML dump of all visible UI elements including text, content descriptions, class names, package names, and screen bounds. This XML snapshot is sent to Google's Gemini API along with hardcoded natural-language prompts instructing the AI to analyze the UI and return JSON-formatted step-by-step instructions for performing the "lock app in recent apps" gesture. The malware executes these instructions via Accessibility Services, sends the updated screen state back to Gemini, and continues until Gemini confirms the app is successfully locked. This AI-driven approach replaces traditional hardcoded tap coordinates and UI selectors, making the malware resilient to UI changes across different devices, manufacturers, and Android versions.

The primary malicious capability is a built-in VNC module that gives operators full remote access to compromised devices — real-time screen viewing and complete device control including taps, swipes, gestures, and text input. C2 communication uses the VNC protocol over a hardcoded server (54.67.2[.]84) with AES encryption using a hardcoded key. Through this channel, the malware receives Gemini API keys, uploads installed app lists, intercepts lockscreen PINs/passwords, captures pattern unlock screens as video recordings, reports screen state and foreground apps, records screen activity for server-specified apps, and takes screenshots on demand.

Anti-removal capabilities exploit Accessibility Services to overlay transparent rectangles on screen areas containing buttons with substrings like "stop", "end", "clear", and "Uninstall" — invisible to users but intercepting all touch interactions on those elements. The only removal method is rebooting into Safe Mode where third-party apps are disabled.

The predecessor VNCSpy appeared on VirusTotal on January 13, 2026 (uploaded from Hong Kong) with three samples. Four PromptSpy dropper samples appeared on February 10, 2026 from Argentina. A companion phishing app (Android/Phishing.Agent.M) shares the same distribution domain, app name, icon, and developer certificate, likely serving as an initial stage leading victims to install PromptSpy.

Development artifacts include debug strings in simplified Chinese and handling for Chinese Accessibility event types, suggesting development in a Chinese-speaking environment. ESET classifies this with medium confidence. This is ESET's second AI-powered malware discovery after PromptLock ransomware (August 2025), the first known case of AI-driven ransomware.

PromptSpy has not been observed in ESET telemetry yet, possibly indicating proof-of-concept status, but the existence of distribution domains and companion apps suggests active development toward deployment. Android users with Google Play Protect enabled are automatically protected against known versions.

## MITRE ATT&CK

- T1398 Boot or Logon Initialization Scripts
- T1541 Foreground Persistence
- T1516 Input Injection
- T1417.002 Input Capture: GUI Input Capture
- T1426 System Information Discovery
- T1418 Software Discovery
- T1513 Screen Capture
- T1663 Remote Access Software
- T1521.001 Encrypted Channel: Symmetric Cryptography
- T1646 Exfiltration Over C2 Channel
- T1476 Deliver Malicious App via Other Means
- T1660 Phishing
- T1575 Native API
- T1655 Masquerading
- T1629.001 Impair Defenses: Prevent Application Removal
- T1406.002 Obfuscated Files or Information: Software Packing
- T1417.001 Input Capture: Keylogging
- T1512 Video Capture
- T1636 Protected User Data

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PromptSpy VNC Remote Access to C2, AES-Encrypted Exfiltration, and Anti-Removal Overlay Detection** (`TL-2026-0135-SPL-003`)

Detects C2/persistence: VNC protocol connection (port 5900) from Android device to C2 54.67.2[.]84 (AWS EC2), AES-128-CBC encrypted data exfiltration over VNC channel (hardcoded key, zero IV), Gemini API key received from non-Google server, transparent TYPE_APPLICATION_OVERLAY on Uninstall/Force Stop buttons for anti-removal, Accessibility Service BACK button override preventing settings access, and RECEIVE_BOOT_COMPLETED auto-restart persistence.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1663, T1521.001, T1646, T1629.001, T1398, T1418
- **Data sources:** firewall_logs, mtd_logs, network_flow_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=firewall sourcetype="firewall_logs"
| search (
    (dest_ip="54.67.2.84" dest_port=5900)
    OR (dest_port=5900 src_device_type="mobile")
)
| eval alert_type="vnc_c2_connection"
| append [
    search index=mobile sourcetype="mtd_logs" event_type="overlay"
    overlay_type="TYPE_APPLICATION_OVERLAY"
    (overlay_target_text="*Uninstall*" OR overlay_target_text="*Force stop*" OR overlay_target_text="*Disable*")
    | eval alert_type="anti_removal_overlay"
]
| append [
    search index=mobile sourcetype="mtd_logs" event_type="boot_receiver"
    action="RECEIVE_BOOT_COMPLETED"
    NOT app_package IN ("com.google.*", "com.samsung.*", "com.android.*")
    | eval alert_type="boot_persistence"
]
| table _time, device_id, src_ip, dest_ip, dest_port, alert_type, app_package
```

### Microsoft KQL

```kql
let vnc = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort == 5900
| extend AlertType = "vnc_c2_connection";
let vnc_ioc = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP == "54.67.2.84"
| extend AlertType = "promptspy_c2_ioc";
let overlay = SecurityAlert
| where Timestamp > ago(24h)
| where AlertName has_any ("overlay_blocking", "anti_removal", "system_alert_window_abuse")
| extend AlertType = "anti_removal_overlay";
let boot = SecurityAlert
| where Timestamp > ago(24h)
| where AlertName has_any ("boot_persistence", "boot_completed_receiver", "auto_start")
| extend AlertType = "boot_persistence";
let app_enum = SecurityAlert
| where Timestamp > ago(24h)
| where AlertName has_any ("app_enumeration", "package_scan", "installed_apps_exfil")
| extend AlertType = "installed_app_reconnaissance";
union vnc, vnc_ioc, overlay, boot, app_enum
| project Timestamp, DeviceName, AlertType, RemoteIP, RemotePort, AlertName
| sort by Timestamp desc
```

### Sigma

```yaml
title: VNC Connection from Mobile Device to Known PromptSpy C2 (54.67.2.84:5900)
id: f0f6327d-71df-41f7-ad90-f08351e97769
status: experimental
description: Detects VNC protocol connection (port 5900) from Android device to PromptSpy C2 server. Also covers anti-removal overlay on system buttons and boot persistence.
references:
    - https://www.welivesecurity.com/en/eset-research/promptspy-first-android-genai-malware/
author: Threadlinqs Team
date: 2026/02/23
tags:
    - attack.command_and_control
    - attack.t1663
    - attack.t1521.001
    - attack.t1646
logsource:
    category: firewall
detection:
    selection_ioc:
        dst.ip: '54.67.2.84'
        dst.port: 5900
    selection_vnc:
        dst.port: 5900
        src.device_type: 'mobile'
    condition: selection_ioc or selection_vnc
falsepositives:
    - Legitimate VNC remote support from mobile device (rare)
    - IT helpdesk using VNC from mobile to manage servers
level: critical
```

**Known false positives:**

- Legitimate VNC remote support from mobile device (rare)
- IT helpdesk VNC from mobile to servers

**Tuning notes:** VNC (port 5900) from mobile device is always suspicious. 54.67.2[.]84 is definitive PromptSpy IOC. Anti-removal overlay detection requires MTD with overlay monitoring capability.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PromptSpy Multi-Signal Detection: Gemini API Abuse, Dropper Sideloading, and Chase Phishing Correlation (locked: unlock with TL Creds)
- Mobile Threat Defense Alert Correlation for PromptSpy Banking Credential Theft and Screen Surveillance (locked: unlock with TL Creds)
- PromptSpy Anti-Removal Overlay, VNC Data Exfiltration, and Banking App Reconnaissance Detection (locked: unlock with TL Creds)
- Accessibility Service Sending Screen XML to Gemini API for AI-Directed UI Manipulation (locked: unlock with TL Creds)
- MediaProjection Screen Recording Triggered by Banking App Foreground Detection (locked: unlock with TL Creds)
- PromptSpy Network IOC Detection: Chase Phishing Domain, Dropper Distribution, and C2 Infrastructure (locked: unlock with TL Creds)
- PromptSpy Dropper Distribution, Chase Bank Phishing, and Gemini AI UI Manipulation Detection (locked: unlock with TL Creds)
- PromptSpy Banking Credential Keylogging, Lockscreen PIN Capture, and Screen Recording Exfiltration (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `54.67.2[.]84`
- Domain: `m-mgarg[.]com`
- File hash: `6BBC9AB132BA066F63676E05DA13D108598BC29B`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0135