You install a banking app. It looks legitimate. It even has the right logo and colors. You enter your credentials. You wait for the "loading" screen to finish.
Behind that loading screen, something else is happening. The malware is not just stealing your bank details. It is talking to Google's Gemini AI, analyzing your screen, and figuring out how to lock itself into your phone's memory so you can never remove it.
This is PromptSpy. It is the first known Android malware to integrate generative AI directly into its execution flow. And it represents a fundamental shift in mobile threats.
Let me show you how we got here, how this malware works, and why the evolution from VNCSpy to PromptSpy is a warning for the future.
⚠️ DISCLAIMER
The content of this article is intended to be informative and protective.
The malware and techniques discussed in this article are genuine and represent existing dangers. The knowledge of their mechanisms of operation is vital for protection against them. This information is intended for security professionals, researchers, and defenders not for malicious use.
Do not attempt to replicate, deploy, or test these techniques on any system or device you do not own or have explicit written permission to test. Unauthorized use of these techniques is illegal and unethical. The author and publisher are not responsible for any misuse of the information contained in this article.
VNCSpy: The First Generation
In January 2026, three malware samples appeared on VirusTotal. They came from Hong Kong. They were crude, but they worked. The malware, later named VNCSpy, was essentially a remote access trojan with a built-in VNC (Virtual Network Computing) module.
Once installed and granted Accessibility permissions, VNCSpy gave attackers full remote control of the device. They could see the screen. They could perform taps, swipes, and text input as if they were holding the phone.
What VNCSpy could do:
- Real-time screen monitoring
- Performing remote commands and actions
- Stealing confidential information from the device
There was one issue with VNCSpy though. A very big issue. VNCSpy made use of fixed coordinates and set gestures for command execution. This is because different Android devices come from different manufactures, and have different screen sizes and OS versions. What worked on a Samsung Galaxy might fail on a Pixel. What worked on Android 14 might break on Android 15.
VNCSpy was fragile.
The Leap: PromptSpy
Just one month later, in February 2026, four new malware samples appeared on VirusTotal. They came from Argentina. The code was based on VNCSpy, but it had a new, sinister component.
The malware could now talk to Google's Gemini AI in real time.
This was not just another Android trojan. This was the first documented Android malware to integrate generative AI directly into its execution flow.
How PromptSpy works
Step 1: Infection
The malware spreads via a banking app pretending to be a genuine bank service. The app is not available at Google Play and is downloaded from a special website which has since been shut down.
Step 2: Installation
Once installed, the app asks for Accessibility Service permission. It is a crucial step because it is a permission that helps those with disabilities. By requesting such a permission, the malware can access all graphical components of the device and be able to read them, click on them, and input texts.
Step 3: The AI Loop
The malware shows a decoy "loading" screen to the user. In the background, it begins a continuous loop:
- PromptSpy captures a complete XML snapshot of the current screen: every UI element, text, class name, and screen coordinate.
- It sends this XML dump along with a predefined prompt to Google's Gemini AI.
- Gemini analyses the screen and provides the instructions in JSON format in steps.
- PromptSpy follows these instructions using Accessibility Services (tap, swipe, long press).
- It then captures the screen state after the execution of the steps and feeds back to Gemini.
- This cycle goes on till Gemini verifies that the app is locked to the list of recent apps.
The AI prompt (translated from the malware code):
"You are an Android automation assistant. The user will give you the UI XML data of the current screen. You need to analyze the XML and output operation instructions in JSON format to achieve the user's goal. Core Judgment Rules: NEVER assume that the job is done. Send the message 'COMPLETED' ONLY if you SEE clear visual proof of completion."
The AI's response (in JSON):
{
"status": "IN_PROGRESS",
"reasoning": "I have accessed the
recent apps list. I can see 'MorganArgs' listed.
The next step is to long-click
on the 'MorganArgs' app card.",
"action": "LONG_CLICK",
"target": "MorganArgs"
}The AI then instructs the malware to tap the "Lock" option, ensuring the app stays active in memory even when the user tries to close it.
Why PromptSpy Is a Game Changer
1. The Malware Learns the UI on the Fly
VNCSpy was blind. It used fixed coordinates and hoped for the best. PromptSpy can read the screen, understand the layout, and decide what to do next. It does not matter if the phone is a Samsung, a Pixel, or a OnePlus. It does not matter if the Android version is 13, 14, or 15. The AI figures it out.
2. The Malware Can Self-Heal
If the user interface changes because of a system update or a different device model, VNCSpy would break. PromptSpy adapts. It reads the new screen, sends it to the AI, and gets new instructions. It thus becomes highly resistant to defense measures.
3. The Malware Is Fully Automated
The attacker does not have to look at the screen and give any commands; the AI will do it all. This means the malware can operate at scale. Thousands of infected devices can be controlled simultaneously without human intervention.
Why This Matters
PromptSpy is not the end of the road. It is the beginning.
The attackers are not just using AI. They are embedding AI into the malware itself.
The AI is not a separate service. It is an integral part of the infection chain. The malware cannot function without it.
This is a fundamental shift. Malware is no longer a static piece of code. It is a dynamic system that can reason about its environment and adapt its behavior.
The implications are terrifying:
- Malware that can read your screen and decide what to steal
- Malware that can bypass two-factor authentication by watching the screen and waiting for the right moment
- Malware that can generate its own phishing pages inside your banking app
The Bottom Line
VNCSpy was a proof of concept. PromptSpy is a warning.
The malware that once relied on hardcoded coordinates now reads the screen, talks to AI, and decides what to do next. It is not a remote control tool anymore. It is an autonomous agent.
The attackers are building malware that thinks. And they are just getting started.
FAQ Section
What is PromptSpy?
PromptSpy is the first known Android malware that integrates generative AI directly into its execution flow. It relies on AI to analyze the phone’s screen and carry out actions.
How does PromptSpy differ from VNCSpy?
The difference is that VNCSpy worked with pre-coded coordinates of the phone’s screen and pre-coded gestures for interaction. In turn, PromptSpy utilizes AI technology to scan the phone’s screen, understand its layout, and decide on the required actions.
How can PromptSpy be installed?
PromptSpy is distributed through fake banking apps impersonating legitimate financial institutions. The apps are not on Google Play. They come from dedicated websites.
What permissions does PromptSpy need?
PromptSpy requires Accessibility Service permissions. This allows it to have complete control of the interface of the device: reading everything from the screen, clicks, swiping, typing.
Is PromptSpy removable?
Yes, but it is supposed to persistently remain on the phone. It locks itself into the Recent Apps menu via AI. Removal requires you to revoke Accessibility permissions and delete the app.
