ESET researchers discover PromptSpy, the first known Android malware to abuse generative AI in its execution flow.

Компанія ESET виявила нове шкідливе програмне забезпечення PromptSpy, націлене на Android, яке вперше використало технологію генеративного штучного інтелекту

« PromptSpy », première 𝗰𝘆𝗯𝗲𝗿𝗺𝗲𝗻𝗮𝗰𝗲 𝗽𝗼𝘂𝗿 𝗔𝗻𝗱𝗿𝗼𝗶𝗱 𝗾𝘂𝗶 𝘂𝘁𝗶𝗹𝗶𝘀𝗲 𝗹'𝗜𝗔 𝗴𝗲́𝗻𝗲́𝗿𝗮𝘁𝗶𝘃𝗲 Aïe… Smartphone menacé ! Si l’on cherchait une (autre) raison de questionner les risques liés à l’#IAgénérative, voici «...

ESET researchers have discovered PromptSpy, the first known Android malware to abuse generative AI in its execution flow to achieve persistence. It is the first time generative AI has been deployed in this manner. Because the attackers rely on prompting an AI model (specifically, Google's Gemini) to guide malicious UI manipulation, ESET has named this family PromptSpy. The malware can capture lockscreen data, block uninstallation attempts, gather device info, take screenshots, record screen activity as video, and more.

Researchers have discovered the first known Android malware to use generative AI in its execution flow, using Google's Gemini model to adapt its persistence across different devices.

Researchers have discovered the first known Android malware to use generative AI in its execution flow, using Google's Gemini model to adapt its persistence across different devices.

Researchers have discovered the first known Android malware to use generative AI in its execution flow, using Google's Gemini model to adapt its persistence across different devices.

PromptSpy Android malware abuses Google Gemini to analyze screens, automate persistence, block removal, and enable VNC-based remote device control.

PromptSpy Android malware abuses Google Gemini to analyze screens, automate persistence, block removal, and enable VNC-based remote device control.

PromptSpy is the first known Android malware to abuse generative AI as part of its execution flow in order to achieve persistence.

The Cyber Mind Co™ has identified PromptSpy as a paradigm-shifting mobile threat—the first Android malware to weaponize Google Gemini at runtime for dynamic persistence. By abusing Accessibility Services and established VNC protocols, PromptSpy bypasses traditional static defenses to achieve full remote device control. This brief provides a technical teardown of the "Architect" level defenses required to neutralize AI-driven payloads, alongside the launch of the Ransier Kit—our definitive hardware blueprint for local network hardening and student home labs.

Sicherheitsforscher haben eine neue Android-Spyware entdeckt, die Googles KI Gemini für ihre Angriffe nutzt. Die als „PromptSpy“ identifizierte Malware kann Geräte fernsteuern, Videos aufzeichnen und wehrt sich hartnäckig gegen Löschversuche. ESET machte die Entdeckung um den 19. Februar publik.AnzeigeAngesichts immer intelligenterer Spyware, die sogar KI für Angriffe nutzt, wird der Basisschutz für das eigene Smartphone […] The post PromptSpy: Erste Android-Malware nutzt Googles KI Gemini appeared first on BornCity.

ESET researchers have discovered PromptSpy, the first known Android malware to abuse generative AI as part of its execution flow in order to achieve persistence. This marks the first time generative AI has been deployed in this way. Because the attackers rely on prompting an AI model, specifically Google’s Gemini, to guide malicious UI manipulation, ESET has named this malware family PromptSpy. The malware can capture lockscreen data, block uninstallation attempts, gather device information, take …

Researchers have discovered the first known Android malware to use generative AI in its execution flow, using Google's Gemini model to adapt its persistence across different devices.