Cybersecurity researchers from ESET have identified PromptSpy, a novel Android malware that marks the first known instance of abusing Google’s Gemini AI chatbot to automate its execution flow and achieve persistence on infected devices. The malware is designed to capture sensitive data such as lockscreen information, block uninstallation attempts, gather device details, and take screenshots, posing a significant threat to user privacy and device security.

This discovery highlights an emerging trend where threat actors leverage legitimate AI tools to enhance malware capabilities, making detection and removal more challenging. The use of Gemini AI for persistence mechanisms underscores the need for increased vigilance and advanced security measures in the mobile ecosystem to combat such sophisticated attacks.

Key Takeaways

  • First Android malware to abuse Google’s Gemini AI for automation and persistence
  • Capable of capturing lockscreen data, blocking uninstallation, and taking screenshots
  • Highlights a new threat vector using legitimate AI tools for malicious purposes
  • Emphasizes the importance of advanced mobile security and user awareness

Source: The Hacker News