Practical guides to protect yourself, your family, and your business from AI-driven scams, deepfakes, and emerging cyber threats.
Most malware ships with its instructions baked in. PROMPTSPY does not. When this Android backdoor wants to act on an infected phone, it photographs the screen, sends the layout to Google's Gemini model in the cloud, and waits for the AI to tell it where to tap. ESET, the security firm that first reported it in February 2026, calls it the first Android malware to wire a generative AI model directly into how it runs.
On May 11, 2026, Google's own Threat Intelligence Group (GTIG, the team that investigates attacks against Google and its users) published a fresh teardown that goes further than the original find, and the picture it paints is the one worth sitting with. The brain of this malware no longer lives in the malware. It sits on a server you cannot see, and it improvises.
The agent module inside PROMPTSPY, named GeminiAutomationAgent, reads the phone's screen through Android's Accessibility API (the system feature that lets screen readers describe apps to blind users), turns the visible layout into a structured list, and sends it to the gemini-2.5-flash-lite model over an ordinary web request. A hardcoded prompt tells the model to adopt a harmless persona, which slips the request past Gemini's safety filters, then asks it to work out the exact coordinates of the buttons on screen. Gemini answers with a tidy set of moves: tap here, swipe there. The malware carries them out as if a finger were doing it.
The detail GTIG added is that the task itself is not fixed. The goal is fed in separately at run time, so the same backdoor can be aimed at almost any on-screen job. ESET first caught it using Gemini to keep itself pinned in the recent-apps list so a user could not swipe it away. GTIG found it does considerably more.
The concrete fact first. This is an early-stage tool, distributed only through a booby-trapped website a victim has to be talked into visiting, and it has not turned up in wide circulation. Google says it has disabled the accounts behind it, and that Play Protect already blocks known versions. So nothing is on fire today. What should hold your attention is the design, because the design is a template other people will copy. By moving its decision-making to a hosted AI, PROMPTSPY stops being a brittle script that breaks the moment an app's layout shifts, and becomes something that adapts to whatever is on the screen. For your organisation the soft spot is the personal Android in an employee's pocket, the one that also holds their work email and their authenticator app. If that device can be driven remotely, the attacker inherits every login it can reach. And because the malware talks to a legitimate Google AI endpoint, its most revealing traffic looks like a routine API call rather than an alarm. The shift worth carrying into your next mobile-security review is this: malware is starting to rent its intelligence from the same cloud models the rest of us use, which lowers the skill needed to build it and blurs the line between hostile and ordinary traffic.
PROMPTSPY matters less for what it has done, which so far is little, than for what it proves is now buildable: malware that outsources its thinking to a commercial AI and improvises its way around your phone in real time. The defenders caught this one early. The blueprint is now public, and the next version will not announce itself. Put mobile install controls and Accessibility-permission hygiene on the agenda at your next security meeting, before an adaptive backdoor is the thing testing them.
