Back Cybersecuritynews

PromptSpy – First Known Android AI Malware Uses Google’s Gemini for Decision

Cybersecuritynews •Guru Baran • February 19, 2026

The first known Android malware family to weaponize a generative AI model, specifically Google’s Gemini, as part of its active execution flow. Discovered in February 2026, the malware represents a significant evolutionary step in mobile threats and follows ESET’s earlier identification of PromptLock, the first AI-powered ransomware, in August 2025. PromptSpy, uncovered by ESET researcher […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PromptSpy: First Android Malware Utilizing Generative AI Discovered ESET researchers have identified PromptSpy, the first Android malware to incorporate generative AI, specifically Google’s Gemini, in its execution flow. This malware utilizes AI to manipulate the user interface and maintain persistence on infected devices, capturing sensitive data and preventing uninstallation. PromptSpy represents a significant evolution in mobile threats, following the earlier discovery of AI-powered ransomware, PromptLock. 39 sources 40

Extracted Entities

PromptSpy – First Known Android AI Malware Uses Google’s Gemini for Decision

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Platforms (2)

Ransomware Groups (1)