Trending Topics

PromptSpy Brings Real-Time AI Decision-Making to Android Malware

PromptSpy is a newly identified Android malware family that integrates Google’s Gemini model to decide, in real time, how to keep itself running on an infected phone. Instead of using fixed-screen coordinates that break across devices, it sends Gemini a written prompt and an XML snapshot of the current screen that includes UI text and element boundaries. Gemini then returns structured instructions that tell the malware what gesture to perform and where to do it, enabling it to keep its malicious app pinned in the Recent Apps view even when the user tries to close it. The malware repeats this cycle by executing the action via Android’s Accessibility Service, capturing the new screen state, and prompting again until it confirms that persistence has been achieved. ESET assesses this as the first known Android threat to put generative AI directly into the malware’s live decision loop, with the primary goal of stealthy persistence and sustained operator control. Beyond persistence, PromptSpy behaves as a full remote-access tool by embedding a VNC-based component that allows operators to view the device screen, simulate taps, and carry out actions remotely once Accessibility access is granted. It can capture lock screen credentials, collect device details, take screenshots, record screen activity, and report which app is currently in the foreground. Command-and-control traffic is encrypted, and the server can deliver a Gemini API key along with campaign instructions, allowing attackers to adjust operations without rebuilding the malware. ESET links it to a multi-stage, financially motivated campaign aimed mainly at users in Argentina, distributed through Spanish-language banking-themed lures hosted on domains impersonating “MorganArg,” with related samples appearing on VirusTotal earlier in January 2026 and more advanced builds in February 2026. Removal is intentionally obstructed by invisible overlays that block taps on uninstall and permission controls, with Safe Mode removal from system settings cited as the dependable cleanup path. Recommended actions include limiting app installs to trusted sources, keeping Play Protect enabled and up to date across devices, and treating any unexpected request for Accessibility access as a high-risk event that should be blocked or escalated immediately.

Update: Windows Infostealer Exfiltrates Browser Logins Wi-Fi Keys and Tokens at Speed

Python-based Windows infostealer, dubbed CharlieKirk Grabber, was designed for fast credential theft and quick exfiltration, not long-term control or disruptive actions. When executed, it runs under the logged-in user, creates a working area in a temporary location, and starts multiple collection threads to finish quickly and reduce the risk of detection. Early in execution, it profiles the device using built-in Windows commands to capture details such as username, hostname, OS version, hardware identifiers, and network configuration, then calls an external IP information service to obtain the public IP, ISP, location, and time zone. It then pivots to credential and session theft across major browser families, targeting saved passwords, cookies, autofill data, and browsing history. To access browser databases that may be locked, it can forcibly terminate active browser processes while suppressing visible windows to remain unobtrusive. The overall pattern is a “smash-and-grab” workflow where it collects broadly, consolidates locally, and moves data off the system with minimal time on target. On the browser side, it enumerates Chromium-based browsers, pulls the encryption master key from each browser’s Local State file, and uses it to decrypt stored logins and related data from SQLite databases. It also targets Firefox and other Gecko-based browsers by using the platform’s credential storage mechanisms to decrypt saved passwords from the browser profile files. Outside the browser, it extracts Wi-Fi passwords by enumerating wireless profiles via Windows utilities and reading the cleartext key output, enabling follow-on access to trusted networks. It searches for Discord authentication tokens in standard storage locations, decrypts them using the same browser key approach, and then validates them against Discord services to retrieve account metadata, including email, phone, and MFA status. It also targets gaming ecosystems by collecting session material tied to Steam and Minecraft to enable account takeover without needing immediate password reuse. After staging artifacts in a temp directory, it compresses everything into a ZIP archive, uploads it to a third-party file hosting service that returns a public link, and forwards that link through Discord webhooks or Telegram bots over HTTPS. Recommended actions include enforcing MFA for corporate and personal accounts, restricting saved passwords in browsers via policy, and monitoring for suspicious bursts of browser termination, rapid ZIP creation in user temp paths, and unusual outbound traffic to file-hosting services and to Discord or Telegram endpoints.

Update: Fake Google Forms Phishing Targets Job Seekers for Account Takeover

A phishing campaign is circulating that impersonates Google Forms to steal Google account credentials, with job seekers appearing to be the primary targets. The links are crafted to appear legitimate at a glance, using a deceptive domain that appears to be a Google subdomain but is actually controlled by attackers. The inclusion of “ss-o” is meant to signal single sign-on and build extra trust, especially for users accustomed to corporate login flows. The campaign also uses a common evasion trick: the link may work only once and then redirect anyone else who tries to open it to a standard Google page, making it harder to investigate or warn others using the same URL. Investigators found a server-side script that appears to generate individualized phishing links, helping attackers scale outreach while keeping each lure unique. The end goal is to get the victim to enter their Google credentials under the guise of a normal application form. When the intended victim opens their personalized link, they land on a convincing counterfeit Google Forms page that closely matches Google branding, layout, and disclaimers. The form presents a job opportunity and collects basic applicant details, then funnels the victim to a “Sign in” step that quietly redirects them to a separate phishing site tied to credential theft activity observed over the past year. Once credentials are entered, attackers can immediately access the Google account, creating downstream risks of identity fraud, financial abuse, and misuse of the inbox to target coworkers, customers, or contacts. The job-offer theme suggests distribution through targeted email outreach and direct messages on professional platforms, with remote-work messaging used to increase response rates. This is a high-impact scenario for both individuals and organizations because a compromised Google account can expose stored documents, trigger password resets, and affect additional connected services. Recommended actions include verifying that any Google Forms login page is truly on Google[.]com before entering credentials and enabling multi-factor authentication on Google accounts to limit damage even if a password is captured.

Top CVEs of the Week

Top CVEs of the Week – As part of our ongoing vulnerability monitoring, the following CVEs highlight recent security issues that could affect a range of systems, applications, and devices. These findings reflect the constantly evolving threat landscape and reinforce the importance of timely patching, secure configurations, and proactive security practices. Below is a summary of notable vulnerabilities, including their impact and any available remediation guidance.