This is the first malware for Android that uses generative AI

Cybersecurity researchers have identified the first malware for Android that uses generative artificial intelligence, called PromptSpy. This malicious program, which leverages Google’s Gemini technology, has the ability to capture data from the lock screen, block uninstallation attempts, and collect device information, in addition to taking screenshots and recording activity in video. Do not download anything unsafe PromptSpy is distributed through a dedicated website and has never been available on Google Play, suggesting that this malware campaign is designed for users in Argentina. According to the analysis, […]

Cybersecurity researchers have identified the first malware for Android that uses generative artificial intelligence, called PromptSpy.

This malicious program, which leverages Google’s Gemini technology, has the ability to capture data from the lock screen, block uninstallation attempts, and collect device information, in addition to taking screenshots and recording activity in video.

Do not download anything unsafe

PromptSpy is distributed through a dedicated website and has never been available on Google Play, suggesting that this malware campaign is targeted at users in Argentina. According to the analysis, there is evidence pointing to its development originating from a Chinese-speaking environment, as simplified Chinese debugging strings have been found.

The operation of PromptSpy is based on Gemini, which allows the malware to analyze the current screen and provides detailed instructions to ensure that the malicious application remains active in the recent list. This is achieved by using accessibility services, which forces users to restart the device in safe mode to uninstall the program. Interaction is done through a command and control server, giving attackers remote access to the victim’s device.

ESET researchers, who made the discovery, point out that PromptSpy represents a significant evolution of Android malware, using generative AI that allows it to adapt to different devices and operating system versions. This approach not only facilitates a more dynamic interaction but also makes it more complicated for users to eradicate it.

It has been indicated that the tactics employed suggest a possible financial objective on the part of the threat actors, highlighting the increasing sophistication of cyber attacks in the mobile space.

Google announces that Android had a total of 107 vulnerabilities through which hackers could infiltrate, but it has already been fixed

Google has disclosed two actively exploited zero-day vulnerabilities in its most recent monthly security update for Android devices. The vulnerabilities, identified as CVE-2025-48633 and CVE-2025-48572, are high-severity flaws affecting the Android framework, allowing attackers to access information and escalate privileges. Despite their severity, they have not yet been included in the U.S. Cybersecurity and Infrastructure Security Agency’s (CISA) catalog of known exploited vulnerabilities. Issues with Android The December security notice is significant, as it includes a total of 107 […]

Google has disclosed two actively exploited zero-day vulnerabilities in its most recent monthly security update for Android devices. The vulnerabilities, identified as CVE-2025-48633 and CVE-2025-48572, are high-severity flaws that affect the Android framework, allowing attackers to access information and escalate privileges. Despite their severity, they have not yet been included in the catalog of known exploited vulnerabilities by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

Problems with Android

The December security notice is significant, as it includes a total of 107 resolved defects, making this the second highest number of patched vulnerabilities this year, only surpassed by the 120 fixed in September. This year has been irregular in terms of vulnerability disclosure, with months where no defects were reported, such as July and October, and a total of only six vulnerabilities in August.

The latest Google update features two patch levels —2025-12-01 and 2025-12-05— that will allow Android partners to address common vulnerabilities across different devices. Android device manufacturers typically release security updates according to their own schedule, customizing operating system updates for their specific hardware.

It has also been indicated that the most critical vulnerability addressed in this patch is CVE-2025-48631, which could allow an attacker to carry out a remote denial of service attack without the need for additional privileges. The update includes fixes for various areas, from the framework and system to critical components from manufacturers such as Qualcomm and MediaTek.

Finally, it has been confirmed that the source code for all the vulnerabilities addressed in this update will be released in the Android Open Source Project repository on Wednesday.

A new Android Trojan will force you to be more careful than ever about what you download

Cybersecurity researchers have revealed new details about a banking trojan for Android called Sturnus, designed for credential theft and full control of devices with the aim of carrying out financial fraud. According to the ThreatFabric report shared with The Hacker News, Sturnus is distinguished by its ability to bypass encryption in messaging applications, thus allowing attackers to monitor communications on platforms like WhatsApp, Telegram, and Signal. Beware of trojans! One of the most alarming features of this trojan is its ability to insert fake login screens that […]

Cybersecurity researchers have revealed new details about a banking trojan for Android called Sturnus, designed for credential theft and complete control of devices with the aim of carrying out financial fraud. According to the ThreatFabric report shared with The Hacker News, Sturnus is distinguished by its ability to bypass encryption in messaging applications, thus allowing attackers to monitor communications on platforms like WhatsApp, Telegram, and Signal.

Beware of Trojans!

One of the most alarming features of this trojan is its ability to insert fake login screens that overlay banking applications, making it easier to capture credentials from unsuspecting users. Its operation is based on a mixed communication mechanism that combines plain text, as well as AES and RSA encryption. This has led experts to point out that its name, Sturnus, refers to the European starling, known for its mimicking ability and diverse vocalizations.

Once activated, Sturnus establishes a WebSocket channel to register the device and receive encrypted payloads. This channel also allows for remote interaction with the compromised device during Virtual Network Computing (VNC) sessions. Additionally, the malware abuses Android’s accessibility services to capture keystrokes and record user interactions.

The trojan can block visual feedback through a full-screen overlay that simulates an operating system update, diverting the user’s attention while carrying out malicious actions. Although its distribution remains limited, its geographical focus on financial institutions in Southern and Central Europe suggests that attackers are refining their tools for broader operations in the future. The extensive monitoring capabilities it allows could facilitate adaptive tactics to evade detection.