PromptSpy: Android Malware That Uses AI to Stay on Your Device

Security researchers at ESET have discovered PromptSpy, the first Android malware known to use a generative AI model as part of how it actually operates. This is a landmark finding because it’s the first time a large language model (LLM) has been built into malware to help it run malicious tasks on a device.The name “PromptSpy” comes from how it works: it sends prompts to Google’s Gemini AI to get step-by-step instructions for controlling the Android interface. With those instructions, the malware can capture your lock screen password, stop you from deleting it, collect device info, take screenshots, and record your screen as video.This comes after ESET found PromptLock in August 2025 — the first AI-assisted ransomware, which used AI to write ransom notes. PromptSpy goes further by using AI to actually navigate the phone and keep itself alive on the device.

How It Spreads and Who It Targets

The malware appears to be financially motivated and aimed at users in Argentina, based on clues found in the code and its distribution setup. It spreads through a fake website and has never appeared on the Google Play Store — likely on purpose to avoid detection. So far it hasn’t shown up much in telemetry data, which suggests it may still be in early or limited deployment.

The app calls itself MorganArg and uses an icon that looks like the JPMorgan Chase banking logo, clearly trying to impersonate a legitimate bank.

How the AI Integration Actually Works

AI makes up only a small part of the code, but it handles a critical job: keeping the app from being closed or removed.

Android launchers on many phones have a “lock” feature in the recent apps list that prevents an app from being swiped away or killed by the system. PromptSpy queries Gemini to get instructions on how to activate that lock — and because the AI generates these instructions dynamically, the malware can adapt to different phone brands, Android versions, and UI layouts without needing separate scripts for each.

According to ESET researcher Lukáš Štefanko, this dramatically expands the malware’s reach across Android’s fragmented device ecosystem. One important limitation: the AI endpoint and the prompt it uses are hardcoded in the malware, so attackers can’t change them after deployment.

The end goal of all this is to get a built-in VNC (Virtual Network Computing) module running, which gives attackers live, interactive remote access to your device.

How It Hides and Avoids Removal

PromptSpy abuses Android’s Accessibility Services — a common trick in mobile malware — to gain elevated control over the device. Through this it places invisible overlay windows over the uninstall screen to block removal, captures whatever you type on the lock screen, and records screen activity and user interactions.

All communication with its command-and-control (C2) server is encrypted using AES (Advanced Encryption Standard), making it harder to detect on the network level.

How to Remove It

ESET disclosed its findings to Google through the App Defense Alliance. As a result, Google Play Protect — on by default on most Android phones — can now detect and block known PromptSpy variants automatically.

Because the malware blocks the normal uninstall process with overlays, you need to boot into Safe Mode, which disables all third-party apps temporarily. Then go to Settings → Apps → MorganArg → Uninstall. To enter Safe Mode on most Android devices, press and hold the power button, then long-press “Power off” and confirm the reboot.

Why This Matters

Right now, PromptSpy only uses AI for one specific task — keeping itself pinned on your device. But the technique shows how LLMs can make malware far more adaptable. Instead of writing separate scripts for hundreds of device configurations, attackers can let AI generate the right instructions on the fly. That’s a meaningful shift in how mobile malware could evolve, enabling more flexible, environment-aware attacks at scale.

References