PromptSpy Android malware abuses Google Gemini AI for persistence

Back Cyberinsider

PromptSpy Android malware abuses Google Gemini AI for persistence

Cyberinsider • February 20, 2026

Share: View original

ESET researchers have uncovered the first known Android malware to incorporate generative AI directly into its execution flow.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PromptSpy: First Android Malware Utilizing Generative AI Discovered ESET researchers have identified PromptSpy, the first Android malware to incorporate generative AI, specifically Google’s Gemini, in its execution flow. This malware utilizes AI to manipulate the user interface and maintain persistence on infected devices, capturing sensitive data and preventing uninstallation. PromptSpy represents a significant evolution in mobile threats, following the earlier discovery of AI-powered ransomware, PromptLock. 39 sources 40

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (2)

Android Google Gemini AI