🤖 PromptSpy: Android Malware Using AI to Control Phones in Real Time
Malware just crossed a new line.
Researchers have discovered PromptSpy, the first known Android malware that uses generative AI to control infected devices in real time.
Instead of relying on traditional malware logic, PromptSpy sends screenshots of the phone’s interface to Google’s Gemini AI model, asking it how to interact with the screen.
The result?
An AI-powered remote access tool capable of adapting to any phone layout, operating system version, or manufacturer interface.
In short, the malware doesn’t need to know where the buttons are.
The AI figures it out.
🧠 How PromptSpy Uses AI
Traditional Android malware depends on:
Hardcoded screen coordinates
UI element identifiers
Device-specific behavior
Those methods break easily when:
Android updates
OEM skins change layouts
Device resolutions vary
PromptSpy solves this problem with AI.
The malware sends Gemini:
• A natural-language prompt
• An XML snapshot of the device screen
• Metadata about UI elements (text, type, location)
Gemini analyzes the interface and responds with JSON instructions telling the malware what gesture to perform.
Examples include:
Tap specific buttons
Long press icons
Swipe elements on screen
This allows the malware to interact with the device as if it were a human user.
🔁 The Persistence Loop
PromptSpy continuously runs a feedback loop.
1️⃣ Capture current screen state
2️⃣ Send screen data to Gemini
3️⃣ Receive gesture instructions
4️⃣ Execute commands using Android Accessibility
5️⃣ Capture the new screen state
6️⃣ Repeat until the objective is achieved
One major goal of this loop is persistence.
The malware repeatedly asks Gemini how to pin the malicious app in the “Recent Apps” list, preventing users from closing it.
Even if the user tries to remove it, the AI adapts to the screen and continues executing commands.
📱 Full Remote Access Capabilities
Once Accessibility permissions are granted, PromptSpy behaves like a full remote access tool (RAT).
Capabilities include:
Viewing the device screen in real time
Simulating taps and gestures
Recording screen activity
Taking screenshots
Capturing lockscreen credentials
Monitoring foreground apps
Collecting device information
Attackers can essentially operate the phone as if they were holding it.
🔐 Command-and-Control Infrastructure
PromptSpy communicates with a remote server using the VNC protocol, encrypted with AES.
The command-and-control server can:
Send control instructions
Deliver campaign-specific Gemini API keys
Issue new tasks for the malware
This architecture allows attackers to update operations dynamically without reinstalling malware.
🚫 Blocking Uninstallation
PromptSpy actively resists removal.
Using Accessibility privileges, the malware places invisible overlays over critical system buttons such as:
“Uninstall”
“Force Stop”
“Disable”
These transparent elements intercept taps, preventing the user from interacting with the system controls.
The result is a phone that appears to ignore attempts to remove the malicious app.
The most reliable removal method is:
Reboot the device into Safe Mode and uninstall the application manually.
🎯 Targeting and Distribution
The campaign primarily targets Spanish-speaking Android users, particularly in Argentina.
Distribution domains include:
mgardownload[.]com
m-mgarg[.]com
These sites impersonate financial services using branding similar to JPMorgan Chase, suggesting a banking fraud theme.
Earlier samples of related malware, called VNCSpy, were uploaded to VirusTotal from Hong Kong in January 2026.
More advanced PromptSpy variants appeared shortly after from Argentina.
🌍 Signs of Global Development
Although the campaign targets Latin American users, code-level analysis revealed indicators suggesting development in a Chinese-speaking environment.
Examples include:
Simplified Chinese debug strings
Accessibility event handling tied to Chinese system formats
This suggests the malware may originate from international threat actors testing campaigns in regional markets.
⚠️ Why PromptSpy Matters
PromptSpy represents a new generation of malware.
Instead of embedding complex logic inside the malware itself, attackers outsource decision-making to AI models.
This creates several advantages for attackers:
Malware adapts to any device interface
Detection signatures become less effective
Development costs drop dramatically
Persistence techniques become more resilient
In essence, the malware becomes AI-assisted automation.
🛡 Protecting Android Devices
Organizations and users should take the following precautions:
1️⃣ Limit Accessibility Permissions
Accessibility services provide powerful control over Android devices and should only be granted to trusted applications.
2️⃣ Install Apps Only from Trusted Sources
PromptSpy is distributed through malicious websites and third-party download portals.
3️⃣ Enable Google Play Protect
Play Protect now detects known PromptSpy variants and blocks installation.
4️⃣ Monitor for Overlay Abuse
Security tools should detect suspicious overlay behavior and abnormal Accessibility usage.
🎯 Strategic Takeaway
The integration of AI into malware is no longer theoretical.
PromptSpy demonstrates how attackers can combine generative AI with mobile malware to create adaptive threats that evolve in real time.
The future of cybercrime may involve malware that asks AI how to hack your device while it’s running.
