aiqbench analysis

This malware campaign represents a significant shift where attackers leverage Google's Gemini AI model via direct API calls to bypass standard Android security controls and maintain persistence after app removal. By using the AI agent to interpret dynamic UI elements, the threat actors effectively turn the phone's own interface into an adaptive navigation system that survives traditional uninstallation attempts. This development highlights critical vulnerabilities in how large language models can be weaponized for remote device control when exposed to untrusted inputs or misused within compromised environments.