We recently reviewed new research from ESET, which has identified an Android malware family dubbed PromptSpy. According to ESET researcher Lukáš Štefanko, this appears to be the first observed Android malware sample using generative AI to maintain persistence on infected devices.

The discovery is notable not because AI is controlling the entire attack, but because of how it is being used: to adapt to user interfaces dynamically and make the malware harder to remove.

What Makes PromptSpy Different?

PromptSpy uses Google’s Gemini generative AI model to interpret what appears on a device’s screen and return instructions for user interface gestures. It then uses those instructions to keep the malicious app locked in the “recent apps” view.

On many Android devices, users can pin or lock apps in the recent apps screen — often indicated by a padlock icon. PromptSpy leverages AI to identify those interface elements and determine the steps required to keep itself locked in that position.

This makes it harder for users to remove the app simply by swiping it away or relying on standard Android behaviour.

As Štefanko explained:

“Since Android malware often relies on UI-based navigation, leveraging generative AI enables threat actors to adapt to more or less any device, layout, or operating system version, which can greatly increase the pool of potential victims.”

The generative AI component is predefined in the malware’s code and cannot be modified without updating the malware itself. While limited to the persistence function, this approach demonstrates how AI can make malware more flexible across different Android versions and device layouts.

Remote Access Capabilities

Beyond AI-assisted persistence, PromptSpy includes more traditional remote-access features.

The malware contains a built-in Virtual Network Computing (VNC) module, giving attackers remote visibility of the device screen and allowing them to perform actions directly on the handset.

According to ESET, PromptSpy can:

• Capture lockscreen data
• Collect device information
• Take screenshots
• Record screen activity as video
• Communicate with command-and-control servers using AES encryption

These capabilities are often associated with account takeover activity, particularly targeting mobile banking users.

Blocking Uninstallation

PromptSpy abuses Android Accessibility Services and screen overlays to resist removal.

It places invisible overlays over parts of the screen, interfering with user taps during the uninstall process. This makes it appear as if the device is malfunctioning when users attempt to remove the app.

ESET recommends rebooting the device into Safe Mode, which disables third-party apps and prevents the overlays from running. From Safe Mode, users can navigate to Settings → Apps, select the malicious app (named MorganArg in this case), and uninstall it.

Steps may vary slightly depending on the device manufacturer.

Distribution and Targeting

PromptSpy has been distributed through a dedicated website and has not appeared on Google Play. ESET shared its findings with Google through the App Defence Alliance.

Google Play Protect blocks known versions of the malware on devices with Google Play Services enabled.

ESET’s analysis suggests the campaign is financially motivated and primarily targeting users in Argentina. The malicious app impersonates a banking brand and uses the name MorganArg, with an icon resembling Morgan Chase branding.

The researchers note that PromptSpy has not yet appeared in broader telemetry, which may indicate a limited campaign or a proof-of-concept operation.

Why This Matters

The AI component in PromptSpy is currently limited to improving persistence. However, it signals a shift in how malware authors may use generative AI in the future.

Rather than replacing traditional malware techniques, AI may enhance them by:

• Adapting automatically to different device layouts
• Automating interaction sequences
• Reducing the need for device-specific scripting

Štefanko noted:

“Even though PromptSpy uses Gemini in just one of its features, it still demonstrates how implementing these tools can make malware more dynamic, giving threat actors ways to automate actions that would normally be more difficult with traditional scripting.”

CSB Perspective

At CSB, we see PromptSpy as an early example of AI being used to make attacks more adaptable rather than more complex.

While the current use case is limited, it demonstrates how AI can help malware overcome small technical barriers that once required manual refinement by attackers. Over time, this could lower the barrier to entry for less sophisticated threat actors.

Organisations should consider this a reminder that mobile devices are no longer secondary endpoints — they are primary gateways to banking apps, corporate email, authentication systems, and cloud services.

Practical steps for users and organisations include:

• Only installing apps from official app stores
• Reviewing Accessibility permissions carefully
• Keeping devices updated
• Ensuring Google Play Protect or equivalent protections are enabled
• Using strong, phishing-resistant authentication methods where possible

 For businesses, mobile device management (MDM) and conditional access controls can significantly reduce the risk of compromised mobile devices accessing sensitive systems.

AI-powered malware is not yet widespread in the mobile space. However, PromptSpy shows how attackers are experimenting with generative AI to increase automation and resilience.

The key takeaway is not alarm, but awareness. AI is becoming part of the attacker toolkit — and defenders must continue evolving visibility, identity protection, and endpoint controls accordingly.