Researchgeminiandroidesetmalware
PromptSpy Integrates Gemini To Achieve Persistence
8.2
On February 19, 2026, ESET disclosed PromptSpy, an Android trojan that integrates Google's Gemini generative model into its runtime to interpret device UI and generate interaction instructions. ESET says the samples appear limited and possibly targeted at Argentine users, but the proof-of-concept shows AI-driven persistence and raises urgent needs for runtime AI-detection, model-call controls, and updated mobile defenses.
Key Points
- 1Finds PromptSpy uses Google's Gemini to interpret UI and generate runtime interaction instructions.
- 2Demonstrates evolution from brittle scripts to adaptive AI-driven automation for persistence across diverse Android devices.
- 3Urgently advises defenders to develop runtime AI-detection, sandboxing, model-call controls, and adaptive malware-hunting workflows.
Scoring Rationale
Strong evidence and novelty from reputable ESET research, but limited current scale and likely proof-of-concept.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems