Researchers of ESET, a global leader in the cybersecurity market, have discovered PromptSpy, the first known Android threat to use generative AI in its execution flow to achieve persistence.
It is the first time that generative AI has been used in this way. Since attackers rely on prompting an AI model (specifically Google Gemini) to guide malicious manipulation of the user interface, ESET has named this family PromptSpy.
The malware is capable of capturing data from the lock screen, blocking uninstall attempts, collecting device information, taking screenshots, recording screen activity in video format, and more. PromptSpy represents the second AI-based threat discovered by ESET Research, following PromptLock, identified in August 2025 and the first known case of AI-driven Android ransomware.
Although generative AI is only used in a relatively limited part of PromptSpy's code (the part responsible for persistence), its use has a significant impact on the adaptability of the threat. In particular, Gemini is used to provide PromptSpy with step-by-step instructions on how to make the malicious app “pinned” in the recent apps list (often marked with a padlock icon in the multitasking view of many Android launchers), thus preventing it from being closed or deleted by the system. The AI model and prompt are predefined in the code and cannot be changed.
"Android malware often relies on user interface navigation; the use of generative AI therefore allows malicious actors to adapt to virtually any device, layout or operating system version, significantly broadening the pool of potential victims,” says Lukáš Štefanko, ESET researcher who discovered PromptSpy. – The main purpose of PromptSpy is to deploy an integrated Virtual Network Computing (VNC) module, which allows operators to gain remote access to the victim's device. This Android malware It also abuses Accessibility Services to block uninstallation via invisible overlays, captures data from the lock screen, and records screen activity as video. It communicates with its Command & Control server via AES encryption.”
PromptSpy is distributed via a dedicated website and has never been available on Google Play. As a partner of the App Defense Alliance, ESET has shared its insights with Google. Android users are automatically protected from known versions of this malware through Google Play Protect, which is active by default on devices with Google Play Services.
Based on clues related to linguistic localization and distribution vectors observed during the analysis, the campaign appears financially motivated and appears to primarily target users in Argentina. However, PromptSpy has not been observed in ESET telemetry so far, which may indicate a proof of concept.
With the app name “MorganArg” and an icon apparently inspired by Morgan Chase, the malware appears to impersonate the Morgan Chase banking institution. “MorganArg,” likely short for “Morgan Argentina,” also appears as the name of the cached website, suggesting a possible regional focus.
Since PromptSpy blocks uninstallation by overlaying invisible items on the screen, the only way to remove it is to reboot your device into Safe Mode, where third-party applications are disabled and can be uninstalled normally.
To enter Safe Mode, users generally need to hold down the Power button, long press “Power Off” and confirm rebooting into Safe Mode (the steps may vary depending on the device and manufacturer). Once your phone reboots into safe mode, you can go to Settings → Apps → MorganArg and proceed with the uninstallation without interference.
