Executive Summary
PROMPTSPY is a sophisticated, multi-stage Android surveillance platform comprising a dropper (com.ntcc.amistore) and a persistent RAT payload (net.ustexas.ami). Disguised as a game launcher named 'Amisore', it uses polished Material Design interfaces and fake progress bars to trick users into installing a bundled APK from its assets folder. The malware has been observed active on corporate networks, indicating potential use for corporate espionage.
Technical analysis reveals that once a victim grants Accessibility permissions, the malware activates a reverse VNC service for real-time screen streaming and remote control. It implements advanced evasion and persistence mechanisms, including manufacturer-specific bypasses for Xiaomi, Huawei, and OPPO, and active monitoring to prevent users from accessing settings to uninstall the app. Hardcoded Chinese-language debug logs suggest development by Chinese-speaking actors.