Case gtig-promptspy-androidAI-assisted malwareWorldwide
PROMPTSPY Android backdoor lets Gemini drive the victim's screen and block uninstall
GTIG expanded on ESET's PROMPTSPY findings: a GeminiAutomationAgent serialises the UI via Accessibility, sends it to gemini-2.5-flash-lite and executes returned taps and swipes; an overlay shields Uninstall.
HighAttack using AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- May 11, 2026
- Location
- Worldwide
- Target
- Android users outside Google Play
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
GTIG expanded on ESET's PROMPTSPY findings: a GeminiAutomationAgent serialises the UI via Accessibility, sends it to gemini-2.5-flash-lite and executes returned taps and swipes; an overlay shields Uninstall.
Impact: Autonomous device control and credential capture on infected phones; infection count not published.
Who triggered it
Actor: Unknown
Attribution: First identified by ESET; GTIG did not attribute an operator.
Motive: Device takeover and credential capture
How it happened
Attack vector: Sideloaded backdoor using Gemini API for autonomous UI interaction and biometric gesture replay
Root cause: Accessibility API plus a public LLM provides a generic on-device automation agent; API keys rotated via C2
Timeline
- ESET first reports PROMPTSPY
- GTIG publishes extended analysis and disables associated assets
Response
Google disabled assets; no apps found on Google Play; Play Protect blocks known versions.
Current status: Contained
Sources (open in a new tab)
- GTIG AI Threat Tracker May 2026 cloud.google.com
- Secure Blink coverage secureblink.com
Cite this case
PROMPTSPY Android backdoor lets Gemini drive the victim's screen and block uninstall. AI Threat Watch, case gtig-promptspy-android, May 11, 2026. https://aithreat.io/cases/gtig-promptspy-android/
Permanent link: https://aithreat.io/cases/gtig-promptspy-android/