Threat reportMalwareTL-2026-1798
ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge Fivefold to 3,000+ Entries; PromptSpy Debuts as First Gemini-Powered Android Malware
ESET's H1 2026 Threat Report (Dec 2025-May 2026 telemetry) documents a fivefold surge in malicious AI agent "skills" between March and May 2026 -- from ~600 to 3,000+ malicious skills out of nearly 900,000 analyzed in public repositories, including skills that bundle credential-dumping and lateral-movement tools like Mimikatz and Impacket.
Key facts for ESET H1 2026 AI skills
| Identifiers | TL-2026-1798 |
|---|---|
| Also known as | PromptSpy, VNCSpy, MorganArg, Malicious AI Agent Skills, ESET H1 2026 Threat Report |
| Severity | MEDIUM |
| Exploitation status | Public proof-of-concept exploit |
| Affected products | Google Gemini API (consumer-facing, abused at runtime by third-party Android malware -- no vendor vulnerability, legitimate API misused via attacker-controlled prompts); Google Android OS (Accessibility Service framework); Multiple Public AI agent skill repositories / marketplaces |
| Malware | Android/Phishing.Agent.M, PromptSpy, VNCSpy |
| Tools | Google Gemini API, Impacket - S0357, Mimikatz, VNC |
| MITRE ATT&CK techniques | T1003 OS Credential Dumping, T1027 Obfuscated Files or Information, T1059 Command and Scripting Interpreter, T1204 User Execution, T1219 Remote Access Tools, T1398 Boot or Logon Initialization Scripts, T1417 Input Capture, T1426 System Information Discovery, T1476 Deliver Malicious App via Other Means, T1512 Video Capture, T1513 Screen Capture, T1521 Encrypted Channel and 5 more in the attack flow |
| Motivation | FINANCIAL |
| Target sectors | financial services, banking, technology, software supply chain, consumer general public |
| Target regions | argentina, Global |
| Detection rules | 9 (1 shown free) |
| Sources | 13 cited sources |
Detection coverage for ESET H1 2026 AI skills
As of 2026-07-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1798 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.
Free detection: Self-Modifying AI Skill Persistence + Obfuscated Credential-Dump/Lateral-Movement Tool Invocation (Splunk)
Detects the post-exploitation stage of the ESET H1 2026 malicious-skill pattern: an AI-agent skill process rewriting its own manifest/config JSON at runtime (self-modifying persistence), combined with base64-obfuscated PowerShell (-EncodedCommand) or Unix-shell (base64 | bash) execution, and/or direct invocation of bundled Mimikatz/Impacket-style tooling (sekurlsa, wmiexec, secretsdump keywords) -- the point where a skill escalates from automation add-on to credential-dumping/lateral-movement implant.
- Languages: Splunk SPL, Microsoft KQL, Sigma
- ATT&CK: T1027, T1059.001, T1003, T1570
- Data sources: sysmon, windows_security, edr_process_creation
- Severity: critical
- Confidence: high
Splunk SPL
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(
(EventCode=11 TargetFilename="*skill_manifest.json")
OR
(EventCode=1 Image="*\\powershell.exe" (CommandLine="*-EncodedCommand*" OR CommandLine="*-enc *"))
OR
(EventCode=1 (CommandLine="*sekurlsa*" OR CommandLine="*mimikatz*" OR CommandLine="*wmiexec*" OR CommandLine="*secretsdump*"))
)
| eval mitre=case(
match(CommandLine,"(?i)sekurlsa|mimikatz"),"T1003",
match(CommandLine,"(?i)wmiexec|secretsdump"),"T1570",
match(CommandLine,"(?i)EncodedCommand|-enc "),"T1059.001,T1027",
isnotnull(TargetFilename),"T1541,T1398,T1628 (self-modifying persistence)")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, CommandLine, TargetFilename, mitre
| where count > 0
| sort -last_seenMicrosoft KQL
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("-EncodedCommand", "-enc "))
or ProcessCommandLine has_any ("sekurlsa", "mimikatz", "wmiexec", "secretsdump")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend DetectionReason = "Obfuscated command execution or bundled credential-dump/lateral-movement tool invocation"
| union (
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName =~ "skill_manifest.json" and isnotempty(PreviousFileName)
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath
| extend DetectionReason = "AI-agent skill self-modified its own manifest at runtime"
)
| order by Timestamp descSigma
title: Malicious AI Skill Self-Modification + Obfuscated Credential-Dump/Lateral-Movement Tool Invocation
id: 8f2b6e2a-1798-4b8e-9f01-a1b2c3d4e5f2
status: experimental
description: Detects base64-obfuscated PowerShell/shell execution or direct invocation of Mimikatz/Impacket-style tooling, optionally correlated with a process previously observed writing an AI-agent skill manifest -- the post-exploitation stage of the ESET H1 2026 malicious-skill pattern.
references:
- https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-31
tags:
- attack.credential-access
- attack.lateral-movement
- attack.defense-evasion
- attack.persistence
- attack.t1003
- attack.t1570
- attack.t1059.001
- attack.t1027
- attack.t1541
- attack.t1398
- attack.t1628
- attack.tool.mimikatz
- attack.tool.impacket
- eset.h1-2026.ai-agent-skill
logsource:
category: process_creation
product: windows
detection:
sel_encoded:
Image|endswith: '\powershell.exe'
CommandLine|contains: '-EncodedCommand'
sel_tooling:
CommandLine|contains:
- 'sekurlsa'
- 'mimikatz'
- 'wmiexec'
- 'secretsdump'
condition: sel_encoded or sel_tooling
falsepositives:
- Legitimate scheduled/CI automation using base64-EncodedCommand PowerShell
- Authorized red-team/pentest use of Mimikatz or Impacket under signed change-control ticket
level: highKnown false positives:
- Legitimate scheduled/CI automation using base64-EncodedCommand PowerShell
- Authorized red-team/pentest use of Mimikatz or Impacket under signed change-control ticket
Tuning notes: Baseline legitimate EncodedCommand usage from RMM/patch-management tooling and exclude those signed binaries by publisher hash; escalate to critical severity only when the tooling-keyword match (sekurlsa/mimikatz/wmiexec/secretsdump) co-occurs with the self-modified-manifest event within a short time window.
- Malicious AI-Agent Skill Manifest Delivery & PromptSpy Dropper/Phishing Infrastructure Contact (Sentinel) · unlock with TL Creds
- Self-Modifying AI Skill Persistence + Obfuscated Credential-Dump/Lateral-Movement Tool Invocation (Sentinel) · unlock with TL Creds
- PromptSpy Gemini-in-the-Loop UI Automation Beacon + VNC C2/Known-IOC Callback (Sentinel) · unlock with TL Creds
- Malicious AI Agent Skill Manifest Declaring Dangerous Capability Set (Sigma) · unlock with TL Creds
- Malicious AI Skill Self-Modification + Obfuscated Credential-Dump/Lateral-Movement Tool Invocation (Sigma) · unlock with TL Creds
- PromptSpy VNC C2 / Dropper / Phishing Infrastructure Contact (Sigma) · unlock with TL Creds
- Malicious AI-Agent Skill Manifest Delivery & PromptSpy Dropper/Phishing Infrastructure Contact (Splunk) · unlock with TL Creds
- PromptSpy Gemini-in-the-Loop UI Automation Beacon + VNC C2/Known-IOC Callback (Splunk) · unlock with TL Creds
Indicators of compromise for ESET H1 2026 AI skills
As of 2026-07-31, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-1798.
Sample indicators (3 of 26)
- IP address:
54.67.2[.]84 - Domain:
mgardownload[.]com - File hash:
6BBC9AB132BA066F63676E05DA13D108598BC29B
Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.
How ESET H1 2026 AI skills works
The same report profiles PromptSpy, an advanced VNCSpy-family Android RAT and the first known Android malware to call a generative-AI model (Google's Gemini) at runtime to interpret on-screen UI elements and drive adaptive, device-independent automation.
ESET Research's H1 2026 Threat Report, covering telemetry from December 2025 through May 2026, identifies two related but distinct developments in AI-enabled threats. First, ESET's tracking of the emerging AI agent "skill" ecosystem -- small, reusable instruction sets that tell an AI agent which tools, services, or data to use for a task -- found explosive growth in malicious content: unique skills analyzed grew from roughly 60,000 in March 2026 to nearly 900,000 by May 2026, suspicious skills grew from about 10,000 to 25,000, and outright malicious skills grew from about 600 to more than 3,000 over the same three-month window. Malicious skills identified by ESET wrap legitimate offensive-security tooling (Mimikatz for credential dumping, Impacket for lateral movement and remote execution) inside agent-consumable packages, include self-modifying skills that write their own persistence mechanisms (JSON-based) and rewrite their own Python logic, and include deliberately weak or fake "security" skills that create a false sense of protection. Warning-sign behaviors ESET flags across this skill supply chain include command execution, file access, credential loading, code injection, obfuscation, and third-party tool downloading -- capabilities that convert a small, seemingly benign automation add-on into a high-risk software-supply-chain component once an AI agent is granted the ability to browse, execute commands, access files, or reach third-party services.
Second, ESET researcher Lukas Stefanko documented PromptSpy, an advanced evolution of the existing VNCSpy Android RAT family and the first known Android malware to embed a call to a generative-AI model in its execution flow. Rather than relying on hardcoded tap coordinates and UI selectors -- which break across different devices, screen sizes, and app versions -- PromptSpy captures the current screen as an XML dump via Android's Accessibility Service, sends that XML together with a fixed "you are an Android automation assistant" prompt to Google's Gemini API, and receives back structured JSON (status, reasoning, action_type, coordinates) describing exactly which UI action to perform next. The malware then executes that action through the Accessibility Service and repeats the request/response loop until its task -- primarily locking the malicious app persistently into the device's recent-apps list -- is complete. PromptSpy additionally ships a built-in VNC module that gives operators full remote-desktop control of the infected device, can intercept lockscreen PINs/passwords, records the pattern-unlock gesture as video, takes screenshots, and uses invisible screen overlays to block the uninstall button. Samples were distributed outside Google Play via a dropper hosted at mgardownload[.]com that led to a phishing page at m-mgarg[.]com impersonating JPMorgan Chase Bank under the app identity "MorganArg," targeting Argentina-based users; the VNC module communicates with a hardcoded C2 host at 54.67.2[.]84. Debug strings and localized event handlers in Simplified Chinese indicate the malware was built in a Chinese-speaking development environment. ESET disclosed the findings to Google prior to publication; Google states no PromptSpy samples were found on Google Play and that Play Protect blocks known versions by default. As of publication, PromptSpy had not been observed in live ESET telemetry, indicating it remains at proof-of-concept / limited-test-campaign stage rather than a widely deployed threat -- but ESET assesses it as a preview of where AI-agent-integrated mobile malware is heading as LLM guardrails are the main current brake on broader adoption.
The same H1 2026 report places both findings in the context of a broader AI-accelerated threat landscape: ClickFix-style fake-error social engineering (detections up 108% H2 2025-H1 2026, now spanning AI-themed help pages, browser extensions/CrashFix, and OAuth-token-theft ConsentFix variants), record levels of QR-code phishing (quishing), and over 100 tracked EDR-killer tool variants (60+ of them BYOVD, abusing 40+ distinct vulnerable drivers). No CVE applies to this entry -- it is a threat-trend and novel-TTP report rather than a discrete vulnerability disclosure -- but it documents a newly emerging, rapidly growing attack surface (the AI agent skill supply chain) and a first-of-its-kind adaptive-malware technique (LLM-in-the-loop UI automation) that both warrant SOC awareness and detection engineering now, ahead of wider adoption.
MITRE ATT&CK techniques by tactic:
Credential Access
Defense Evasion
T1027 Obfuscated Files or Information
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
Persistence
T1398 Boot or Logon Initialization Scripts; T1541 Foreground Persistence
collection
Discovery
T1426 System Information Discovery
initial-access
T1476 Deliver Malicious App via Other Means; T1660 Phishing
Collection
T1512 Video Capture; T1513 Screen Capture
command-and-control
Lateral Movement
defense-evasion
Exfiltration
Remediation for ESET H1 2026 AI skills
Immediate actions
- Confirm Google Play Protect is enabled fleet-wide on managed Android devices -- Play Protect blocks known Android/Spy.PromptSpy.A and Android/Spy.VNCSpy.A signatures even for sideloaded APKs, regardless of install source.
- Block or heavily restrict installation from unknown/non-Play sources via MDM policy, particularly for banking-branded APKs delivered through SMS or phishing links.
- Block network egress to 54.67.2[.]84, m-mgarg[.]com, and mgardownload[.]com at perimeter, DNS, and mobile-device firewall layers.
- Inventory and audit any internally-adopted AI agent 'skills' or plugins for command-execution, credential-loading, file-access, or third-party-tool-download capability before allowing them into production agent environments.
Workarounds
- Disable 'install from unknown sources' on Android devices where sideloading is not operationally required.
- Restrict AI agent runtime permissions to least-privilege tool access so skills cannot invoke arbitrary command execution, credential stores, or third-party downloads without explicit approval.
Longer-term hardening
- Stand up a security review/vetting gate for AI agent skills before activation, treating the skill ecosystem as a software-supply-chain surface analogous to package/dependency review (SCA-style scanning for embedded tools like Mimikatz/Impacket, self-modifying code, and obfuscation).
- Deploy mobile threat defense (MTD) with behavioral detection for Accessibility Service abuse, anomalous VNC/remote-control sessions, and unexpected outbound calls from mobile apps to third-party LLM APIs (e.g., Gemini) that have no legitimate reason to invoke one.
- Extend user-awareness training to cover sideloaded banking-app impersonation and AI-agent-skill supply-chain risk alongside traditional phishing training.
- Track EDR-killer/BYOVD driver-abuse trends (100+ variants, 60+ BYOVD across 40+ drivers per this report) in vulnerable-driver blocklists (e.g., Microsoft's recommended driver block rules).
Affected and fixed versions
- Google — Gemini API (consumer-facing, abused at runtime by third-party Android malware -- no vendor vulnerability, legitimate API misused via attacker-controlled prompts)
Vulnerable versions: N/A -- legitimate API abused by malware, not an API flaw - Google — Android OS (Accessibility Service framework)
Vulnerable versions: All Android versions exposing standard Accessibility Service APIs to installed apps - Multiple — Public AI agent skill repositories / marketplaces
Vulnerable versions: Skill submissions accepted without pre-publication security vetting
Timeline of ESET H1 2026 AI skills
- First locked-ioc-26 predecessor Android RAT samples (net.ustexas.myavlive.apk and related) uploaded to VirusTotal, submitted from Hong Kong.
- Advanced Gemini-integrated locked-ioc-22 dropper and payload samples (mgappc-1.apk, app-release.apk) uploaded to VirusTotal, submitted from Argentina.
- locked-ioc-22 findings are independently covered by BleepingComputer, The Hacker News, SecurityWeek, Security Affairs, The Register, and Android Authority.
- Google issues a statement confirming no locked-ioc-22 samples were found on Google Play and that Play Protect automatically blocks known versions of the malware by default.
- ESET researcher Lukas Stefanko publishes 'locked-ioc-22 ushers in the era of Android threats using GenAI' on WeLiveSecurity, detailing the malware's Gemini-driven UI automation, VNC module, and Argentina-targeted Chase Bank phishing infrastructure.
- ESET's tracking window for AI agent skill repositories begins: approximately 60,000 unique skills analyzed, ~10,000 flagged suspicious, ~600 flagged malicious.
- ESET's AI agent skill repository tracking window closes: nearly 900,000 unique skills analyzed, 25,000+ flagged suspicious, 3,000+ flagged malicious -- a roughly fivefold increase in malicious skills over three months.
- ESET Research publishes the H1 2026 Threat Report (Dec 2025-May 2026 telemetry) on WeLiveSecurity, formalizing the malicious AI agent skills findings alongside the locked-ioc-22 profile, ClickFix, quishing, and EDR-killer trend data.
Sources cited for ESET H1 2026 AI skills
- ESET Threat Report H1 2026 ESET WeLiveSecurity · Vendor report · 2026-07-08
- ESET Threat Report H1 2026 (full PDF) web-assets.esetstatic.com · Vendor report · 2026-07-08
- PromptSpy ushers in the era of Android threats using GenAI ESET WeLiveSecurity · Research · 2026-02-19
- ESET Research discovers PromptSpy, the first Android threat to use generative AI eset.com · Vendor report · 2026-02-19
- ESET tracks rise in malicious AI skills and adaptable malware BleepingComputer · News · 2026-07-08
- PromptSpy is the first known Android malware to use generative AI at runtime BleepingComputer · News · 2026-02-19
- PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence The Hacker News · News · 2026-02-19
- PromptSpy Android Malware Abuses Gemini AI at Runtime for Persistence SecurityWeek · News · 2026-02-19
- PromptSpy abuses Gemini AI to gain persistent access on Android securityaffairs.com · News · 2026-02-19
- Android malware is now using Gemini AI to adapt in real time (Updated: Google statement) androidauthority.com · News · 2026-02-19
- Android malware taps Gemini to navigate infected devices The Register · News · 2026-02-19
- Thousands of malicious AI skills found capable of stealing data, running malware Help Net Security · News · 2026-07-08
- ESET Threat Report H1 2026 Highlights Malicious AI Skills, ClickFix Surge, and EDR Killers gbhackers.com · News · 2026-07-08
Further reading
Drafted by the Threadlinqs research pipeline from 13 sources; published ; last updated —.
