PromptSpy ushers in the era of Android threats using GenAI

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/
• Blog Title: PromptSpy ushers in the era of Android threats using GenAI
• Suggested Section: Mobile Pentesting -> Android Applications Pentesting -> Accessibility Services Abuse (add subsection: LLM/GenAI-driven UI automation via Accessibility UI XML prompts)

🎯 Content Summary

Overview

ESET describes PromptSpy, the first known Android malware family observed to abuse generative AI (Google Gemini) inside its execution flow to perform context-aware UI automation. The GenAI usage is focused on a persistence subroutine (locking/pinning the malicious app in the Recent Apps list), but the main payload is a built-in VNC remote access component (full interactive remote control). The malware also abuses Accessibi...

🔧 Technical Details

GenAI-driven UI automation loop (prompt-in-the-loop): Use Android Accessibility to dump the current UI tree as XML (including node bounds formatted [left,top][right,bottom]), then prompt a generative AI model to return strict JSON instructions (status = IN_PROGRESS/COMPLETED/IMPOSSIBLE plus action_type like CLICK/LONG_CLICK/SWIPE). The model is instructed to compute click coordinates by taking the center of the bounds rectangle and to only mark COMPLETED when the XML shows explicit evidence of success. Execute the action via Accessibility, re-dump UI XML, and iterate while preserving prior prompts/responses for context. This makes device/vendor-specific UI workflows (e.g., “lock app in Recents”) resilient across different Android skins and layouts.

VNC RAT over encrypted channel: Embed a VNC component for interactive remote control (screen viewing + input injection via Accessibility). Communicate with a ha...

🤖 Agent Actions

Updated accessibility-services-abuse.md with a new subsection on LLM/GenAI-driven UI automation, detailing the XML dump → strict JSON action → Accessibility execution loop (coordinates derived from bounds) used to lock/pin apps across OEM UIs. Added anti-removal transparent overlay technique targeting uninstall/Accessibility flows, and referenced the PromptSpy blog in the References section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting -> Android Applications Pentesting -> Accessibility Services Abuse (add subsection: LLM/GenAI-driven UI automation via Accessibility UI XML prompts)".

Repository Maintenance:

• MD Files Formatting: 948 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0