# PromptSpy ushers in the era of Android threats using GenAI

PromptSpy Android malware abuses Gemini to read UI XML and issue tap instructions to pin itself in recent apps, then deploys VNC for full remote device control.

- Payout: Research
- Severity: high
- Program: PromptSpy
- Write-up by: ESET Research
- Disclosed: 2026-02-19
- Write-up quality: 7/10
- Original: https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/
- Library page: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-promptspy-ushers-in-era-android-threats-using-genai
- Tags: area:mobile domain:mobile impact:ato impact:data-leak kind:research platform:threat-intel sev:high tech:android tech:llm technique:chained technique:reverse-engineering vuln:access-control vuln:info-disclosure

**Target:** Android app (dropper + payload APK) with Accessibility Service and VNC C2
**Root cause:** Malware abuses Accessibility Service to read screen UI and inject gestures; hardcoded Gemini prompt with UI XML dump returns JSON tap instructions to lock app in recents, and a built-in VNC module with AES-encrypted C2 gives operators full device control.
**Steps:**
1. Dropper `mgapp*.apk` prompts install of embedded `app-release.apk` payload from assets
2. Payload requests Accessibility Service permission, shows decoy loading activity
3. Uses Accessibility to open Recents and serialize UI (text, class, package, bounds) to XML
4. POSTs prompt + UI XML to Gemini; parses JSON `action_type`/`x`/`y` and executes via Accessibility
5. Loops until Gemini returns `COMPLETED` confirming app lock in recents
6. Connects to C2 `54.67.2[.]84` over VNC with AES hardcoded key; receives Gemini API key, exfiltrates installed apps, captures lockscreen PIN/pattern video, screenshots, screen recording
7. Overlays invisible rectangles over buttons containing `stop`, `end`, `clear`, `Uninstall` to block removal
**How found:** ESET pivoted from VirusTotal samples uploaded from Hong Kong (VNCSpy) and Argentina (PromptSpy), noticed Chinese debug strings and Accessibility event handling, and traced the Gemini prompt/response loop in code; distribution domain and cached fake Chase Bank site linked the campaign.
**Exploitation:** Victim installs dropper from `mgardownload[.]com`, manually installs payload, grants Accessibility. Malware locks itself in recents via Gemini-guided taps, then operator connects over VNC to view screen, inject taps/swipes/text, harvest lockscreen credentials, and record activity. Removal requires Safe Mode.
**Escalation:** Accessibility Service abuse chained with AI-driven UI automation for persistence, then VNC for full remote control and credential capture; invisible overlays block uninstall.
**Insight:** When auditing Android malware or Accessibility-abusing apps, look for UI XML serialization plus LLM prompt/response loops as a device-agnostic automation primitive; also check for invisible overlay rectangles matching button substrings like 'Uninstall' as an anti-removal trick.