Android malware taps Gemini to navigate infected devices

ESET researchers identified PromptSpy, a proof-of-concept Android malware that uses generative AI (Google Gemini) to parse UI XML dumps and return JSON instructions to perform adaptive gestures, enabling persistence, VNC remote control, credential interception, screen recording, and uninstall prevention; samples were found on VirusTotal and linked to a likely distribution domain (now offline), but ESET has not observed active deployment in its telemetry.