PromptSpy: Android Malware Uses Gemini AI for Persistence and Data Capture

Researchers discovered PromptSpy, an innovative Android malware that uses Google's Gemini AI model for an unprecedented capability: understanding and interacting with the infected device's graphical interface to ensure persistence and collect data more effectively. The malware takes periodic screenshots, sends them to the Gemini API, and uses responses to "understand" what's on screen — even as the interface changes with updates. This allows identifying open banking apps, reading 2FA notifications, and detecting removal attempts. Primarily distributed through fake APKs in Argentina. Protect yourself by only installing apps from the official Play Store and regularly reviewing accessibility permissions.