Android Malware Hijacks Google Gemini to Stay Hidden

ESET researchers identified PromptSpy, an Android malware implant evolving from VNCSpy that uses Google’s Gemini generative AI plus Accessibility Services to automatically interact with device UIs and lock itself in the Recent Apps list for persistence; it provides VNC-based remote control to capture screens, intercept PINs/patterns, record gestures, and exfiltrate data, and was distributed via a banking-themed trojan (MorganArg) impersonating JPMorgan Argentina with IOCs including mgardownload.com / m-mgarg.com and C2 54.67.2.84.