PromptSpy Android Malware Abuses Gemini AI at Runtime for Persistence

Back Feeds.Feedburner

PromptSpy Android Malware Abuses Gemini AI at Runtime for Persistence

Feeds.Feedburner •Eduard Kovacs • February 20, 2026

Share: View original

The malware leverages Gemini to analyze on-screen elements and ensure that it remains on the device even after a reboot.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PromptSpy: First Android Malware Utilizing Generative AI Discovered ESET researchers have identified PromptSpy, the first Android malware to incorporate generative AI, specifically Google’s Gemini, in its execution flow. This malware utilizes AI to manipulate the user interface and maintain persistence on infected devices, capturing sensitive data and preventing uninstallation. PromptSpy represents a significant evolution in mobile threats, following the earlier discovery of AI-powered ransomware, PromptLock. 39 sources 40

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

T1547 - Boot Or Logon Autostart Execution

Platforms (1)

Tools (1)