PromptSpy Weaponizes Google Gemini: ESET Finds 3,000+ Malicious AI Skills in H1 2026

PromptSpy reached its victims through a dedicated distribution chain. The campaign registered m-mgarg[.]com as a phishing site impersonating JPMorgan Chase Argentina under the app name "Morgan Argentina." The site directed victims to download the malicious APK from the infrastructure domain mgardownload[.]com. Once installed, the app requested Android Accessibility Service permissions -- a standard request for banking apps in the region -- which gave PromptSpy unrestricted access to every UI element displayed on the device.

The Gemini integration operates as a runtime query loop. PromptSpy captures the current screen state as an XML file listing every visible UI element: text labels, class types, button coordinates, and scroll positions. It sends this XML plus a task instruction to Google's Gemini API. Gemini analyzes the current screen and returns a JSON response specifying which element to tap, which gesture to perform, or which text to enter. PromptSpy executes that instruction through the Accessibility Service and repeats the loop until the task is confirmed complete.

ESET confirmed the primary use of this loop was achieving persistence in the Android Recent Apps list -- pinning PromptSpy so the OS memory manager could not terminate it. Traditional Android malware hardcodes UI element IDs for this operation, which break across Android versions and device manufacturers. PromptSpy bypasses that limitation entirely by asking Gemini to read whatever screen state currently exists and determine the correct action for that specific device.

With persistence established, PromptSpy activates a VNC module enabling full remote device control. Exfiltrated data includes the installed application list, lock screen PINs and pattern-unlock sequences recorded as video, screenshots on demand, and the currently active foreground application. To prevent removal, the malware overlays invisible transparent rectangles over UI buttons labeled "stop," "end," "clear," and "Uninstall" -- redirecting user taps to inert screen areas.

Machine learning models were previously used by Android malware to analyze screenshots for ad fraud. PromptSpy is the first confirmed deployed case of Android malware integrating generative AI directly into its real-time execution flow, as documented by ESET Research in February 2026.

PromptSpy is the most visible artifact in a much larger documented shift. ESET's H1 2026 Threat Report covers January through June 2026 and places PromptSpy within a broader pattern of AI weaponization that reached enterprise AI infrastructure directly.

Between March and May 2026, ESET analyzed 900,000 AI agent skills sourced from publicly available repositories. These are the installable components that enterprise AI agent platforms, workflow automation tools, and AI copilot systems use to extend their functionality. The analysis found more than 25,000 skills showing suspicious characteristics warranting investigation. More than 3,000 were confirmed malicious. Several confirmed malicious skills embedded Mimikatz, the credential-dumping tool central to virtually every major enterprise breach of the past decade. Others embedded Impacket, the Python toolkit used for lateral movement, pass-the-hash attacks, and DCSync operations against Active Directory.

The attack vector is distinct from traditional supply chain compromise. A malicious AI skill can pass a superficial code review because the harmful behavior is conditional -- triggered only when called with specific parameters or when the agent operates in a targeted environment. Organizations deploying AI agent platforms from public repositories inherit this risk without the software vetting controls applied to traditional packages.

ClickFix social engineering also showed sustained acceleration in ESET's H1 2026 telemetry. Detections more than doubled from H2 2025 to H1 2026 as the technique expanded beyond fake CAPTCHA pages into AI-themed help pages, browser extension prompts, and cloud authentication workflows. The overlap with AI theming is deliberate: users conditioned to follow AI assistant guidance are predisposed to execute instructions presented in a familiar AI interface context, according to ESET's analysis.

PromptSpy is the mobile expression of an AI weaponization pattern Group-IB has documented across five active criminal and nation-state categories.

Dark LLMs provide the infrastructure layer. Group-IB identified three vendors offering self-hosted models exceeding 80 billion parameters with zero ethical guardrails, priced between $30 and $200 per month with an estimated active user base exceeding 1,000. These models generate phishing kits, produce functional malware code, obfuscate existing payloads, and write social engineering scripts on demand. Some are fine-tuned on penetration testing datasets and scam linguistics -- not jailbroken consumer models, but purpose-built attacker tools.

AI-assisted deepfake fraud is producing measurable financial losses at scale. Deepfake-related losses totaled $350 million in Q2 2025 according to Resemble.ai data cited in Group-IB's analysis. The Arup case is the single most documented example: a live deepfake Zoom call with a video overlay of the CFO and colleagues convinced a finance employee to transfer $25 million in a single session. Underground criminal groups now recruit dedicated AI video actors and deepfake presenters via Telegram to supply live impersonation services to fraud operations.

AI phishing tools generate personalized lures at industrial scale. By early 2025, AI-supported phishing represented more than 80 percent of observed social engineering activity worldwide, with dynamic language generation bypassing content-similarity filters and automated variation reducing duplicate detection.

As documented in our analysis of AI-driven live operations using Gemini for APT targeting, nation-state actors have confirmed this capability in production targeting. The AI tooling available to a criminal subscribing to a $200/month dark LLM today matches what nation-state actors were using experimentally eighteen months ago.

Two domains formed the dedicated PromptSpy distribution infrastructure. Block both at your corporate DNS resolver and enterprise web proxy immediately. The malicious app package name is the primary MDM detection target for any organization managing Android devices.

VirusTotal samples were uploaded from Hong Kong on January 13, 2026 and from Argentina on February 10, 2026. ESET reported no telemetry detections consistent with broad distribution, but the existence of dedicated infrastructure and a polished phishing lure indicates a targeted financially motivated campaign -- not a proof of concept. Organizations with operations or employees in Argentina should treat any financial app installed from outside the Google Play Store with elevated suspicion.

Any Android device with Accessibility Service permissions granted to an unrecognized app warrants immediate investigation. PromptSpy specifically requests these permissions in a financial app context where users are conditioned to grant them.

Standard mobile threat detection relying on static signature matching is insufficient against generative AI malware. PromptSpy's behavior is generated at runtime by Gemini in response to whatever the device currently shows -- there is no fixed code path to fingerprint. Defense requires behavioral MDM controls, AI skill vetting, and network-layer blocking.

The most effective immediate action is blocking the two known PromptSpy domains at your corporate DNS resolver. For broader generative AI malware defense, the controls below address both the mobile vector PromptSpy exploits and the enterprise AI infrastructure vector that malicious AI skills exploit.

Organizations managing AI agent deployments should also review recent AI-generated malware campaigns targeting enterprise automation infrastructure for additional context on how malicious skills operate in practice.

The security significance of PromptSpy is not its current distribution scale -- ESET's limited telemetry suggests a targeted campaign rather than mass exploitation. The significance is the capability it proves at production scale.

Conventional mobile malware is brittle. Android version updates, manufacturer UI customizations, and app security patches each break hardcoded malware behaviors and force attacker tooling updates. Generative AI malware replaces hardcoded logic with a model that interprets whatever state it encounters. An attacker deploying PromptSpy against enterprise targets does not need to test against every Android version in the organization's fleet. The AI adapts on first contact.

This capability will appear in other contexts. Desktop and server malware that queries an LLM to navigate an enterprise environment in real time is a direct architectural extension of what PromptSpy demonstrated on Android. The 3,000+ malicious AI skills ESET found in enterprise repositories represent the same principle applied to the workflow automation infrastructure organizations are deploying at accelerating rates without equivalent security controls.

For security teams, three controls matter most in the near term: MDM enforcement blocking side-loaded apps and governing Accessibility Service permissions; AI skill provenance vetting before any enterprise deployment; and threat intelligence subscriptions covering known malicious AI infrastructure including dark LLM command-and-control domains.

ESET's H1 2026 documented escalation -- ClickFix detections doubling, 3,000+ malicious AI skills confirmed, PromptSpy demonstrating runtime generative AI execution in the wild -- establishes a new baseline. The organizations that treat this as a category change in the mobile and enterprise AI threat landscape, rather than an incremental update, are those positioned to defend against the next iteration of this capability before it reaches their environment.