How the phone ends up being controlled remotely
Table of Contents
PromptSpy hides in a fake app called “MorganArg” that mimics the official JPMorgan Chase bank app. It is not available in Google Play, but on fake sites that copy official pages.
People think they are downloading a banking app. In reality, it installs a program that takes control of the phone.
After installation, the app asks for access to “accessibility features“. This option is designed for the visually impaired and allows an application to see everything on the screen and press buttons for the user.
If you hit “Allow”, you’re basically giving the app your phone keys, and that’s where the dangerous part begins. The malware uses the Google Gemini artificial intelligence model to analyze what you see on the screen. Artificial intelligence “understands” where the buttons are, which application is open and what to press next.
In short, the phone can:
- to read typed passwords
- to intercept authentication codes
- to open the banking application
And all these may seem like normal actions, because the app moves exactly like a real user.
Why is it different from other viruses?
Most malware steals data. PromptSpy goes further: it uses artificial intelligence to “think” and decide for itself what steps to take next. Experts say this makes it dangerous on almost any Android phone, regardless of model.
According to ESET, most cases were reported in Argentina, but the technology can be used anywhere. The app was not found in official stores, which means it is distributed through fake links or sites.
How do you know something is wrong?
The signs can be subtle:
- the battery drains very quickly
- apps you haven’t installed appear
- the phone opens apps by itself
If you notice something like this, your device may be compromised.
What you need to do to protect yourself
The basic rule is simple: install apps only from Google Play. Do not download banking applications from links received by email, SMS or social networks, do not give access to the accessibility features of an unknown application, enable Google Play Protect and perform system updates. If you suspect your phone is infected, start it in safe mode and uninstall suspicious apps.
This type of attack shows how quickly artificial intelligence tools can be used for illegal purposes. A seemingly normal app can end up taking complete control of your phone and emptying your account in just minutes if you give it access without double-checking.
Subscribe to THE NEWS OF THE DAY to stay up to date with the latest information.
Watch the newest VIDEO
