GoPlus Security has identified a new Android malware named PromptSpy that exploits AI technology to remotely control victim devices. The malware is typically distributed through fake banking phishing sites, tricking users into downloading APKs not available on Google Play. It then requests permission to "install apps from unknown sources" to deploy its core payload. A key feature of PromptSpy is its use of the Google Gemini API to send the device's current UI XML structure to a large model for analysis, with AI returning real-time instructions for malicious control. GoPlus advises users to avoid installing APKs from unknown sources, be cautious with accessibility permissions, and enable Google Play Protect.