Android malware uses Google’s own Gemini AI to adapt in real time

Update: February 20, 2026 (05:12 PM ET): Following our request for comment and the publication of the original article below, a Google spokesperson provided us with the following statement:

“Based on our current detection, no apps containing this malware are found on Google Play. Android users are automatically protected against known versions of this malware by Google Play Protect, which is on by default on Android devices with Google Play Services. Google Play Protect can warn users or block apps known to exhibit malicious behavior, even when those apps come from sources outside of Play.”

The ESET researchers had already shared their findings with Google, and similar assurances to those in the statement above are echoed in the report. Despite the abilities this malware demonstrates, there seems to be very little risk to Android users at this stage.

Original article: February 20, 2026 (01:19 PM ET): It’s been a worrying week on the Android malware front. On Tuesday, we learned of tablets shipping with hidden malware already embedded in their firmware. Now, researchers say they’ve spotted something arguably more futuristic: Android malware that uses Google’s own Gemini AI model during execution.

According to a report highlighted by BleepingComputer, ESET researchers have uncovered a new Android malware family dubbed PromptSpy. Unlike traditional malware that relies entirely on hardcoded instructions, this strain queries Google’s Gemini generative AI model at runtime to help it carry out part of its behavior. In this case, the malware sends Gemini information about what’s currently visible on the infected device’s screen and asks for guidance on what to do next. That allows it to adapt to differences between Android devices and interfaces, rather than relying on a rigid script that might only work on certain models.

ESET says this is the first known example of Android malware integrating generative AI directly into its execution flow. While the AI component is used for only one feature in this example, it shows how attackers can leverage publicly available AI tools to make malware more flexible and harder to design against.

Beyond the disturbing AI development, PromptSpy functions as spyware. It reportedly includes a built-in remote access module and can collect information such as installed apps and lockscreen credentials once it gains the necessary permissions. It also attempts to make removal more difficult by interfering with efforts to disable it.

So far, ESET says it hasn’t observed PromptSpy or its dropper in its telemetry, making it unclear whether the malware is actively spreading or remains closer to a proof-of-concept. However, researchers noted that the samples were distributed via a dedicated domain and impersonated a major bank, suggesting they may not be purely experimental.

Even if its reach and scope are limited for now, the broader takeaway is hard to ignore. Generative AI isn’t just being used to create malicious content — it’s starting to shape how malware behaves in real time. Attackers using Google’s own AI tools against Android in this instance only adds to the concern, and we have reached out to Google for comment on the matter. We will update this article with any response we receive.