AI Chatbots Weaponized: Hackers Turn Gemini and Browsing Features into Stealth C2 Channels

The cybersecurity landscape is witnessing the birth of a novel and insidious threat vector: the weaponization of legitimate, cloud-based Artificial Intelligence services. Threat actors are now actively repurposing AI chatbots—specifically those with integrated web browsing functionalities—to function as stealthy command-and-control (C2) relays for malware. This technique marks a significant evolution in evasion tactics, moving away from traditional, easily blacklisted C2 servers and towards abusing the trusted infrastructure of major tech giants.

The Anatomy of an AI-Powered C2 Channel

The core of this attack methodology lies in exploiting the dual nature of modern AI assistants. Services like Google Gemini, Microsoft Copilot, and others offer not just conversational AI but also the ability to fetch real-time information from the web. From a security perspective, this creates a sanctioned outbound channel. Malware operators have ingeniously co-opted this channel. Instead of having infected devices call home to a suspicious domain, the malware instructs the local AI chatbot—via automated scripts or hidden prompts—to visit a specific attacker-controlled webpage. This webpage, which may look innocuous, contains the next set of commands encoded within its content.

The AI service, acting as an unwitting proxy, fetches this data. The malware then scrapes the chatbot's response or interface to retrieve the hidden instructions. This process effectively makes the AI's web request the C2 communication, blending malicious traffic seamlessly with legitimate, high-volume traffic to domains like google.com or bing.com, which are rarely blocked by corporate firewalls or scrutinized with the same suspicion as unknown IPs.

Case Study: PromptSpy and the Automation of Persistence

A concrete example of this trend is the 'PromptSpy' malware family targeting Android devices. As documented by cybersecurity researchers, PromptSpy demonstrates a multi-faceted abuse of AI. Its primary function is espionage, designed to steal sensitive user data. However, its innovative use of Google's Gemini app for persistence is what sets it apart.

Upon infection, PromptSpy employs Android's accessibility services—a feature meant to aid users with disabilities—to gain deep control over the device. It then automates interactions with the Gemini app. One of its key automated routines involves repeatedly opening the 'Recent Apps' menu. This seemingly odd behavior is a calculated persistence mechanism. On many Android systems, frequently used apps are less likely to be killed by the operating system's memory management. By ensuring the Gemini app (and by potential association, its own processes) remains 'active,' the malware increases its longevity on the infected device.

This synergy between malware and a legitimate AI app creates a powerful stealth combination. The malware uses the AI service as both a tool for maintaining its foothold and, potentially, as the channel for data exfiltration or command retrieval via the browsing feature, all while operating under the guise of normal user activity.

Implications for Enterprise Security and Detection

This evolution presents profound challenges for security operations centers (SOCs) and network defenders:

1. Traffic Camouflage: C2 traffic is no longer a call to a bulletproof server in a foreign country. It is an HTTPS request to a major, trusted cloud provider, often indistinguishable from legitimate user queries to the AI service.
2. Domain Reputation Blindness: Security tools that rely on domain and IP reputation lists are rendered ineffective. Blocking access to Google or Microsoft's AI services is not a viable option for most enterprises.
3. Behavioral Analysis Hurdles: Detecting anomalous network traffic becomes exceedingly difficult. The focus must shift to endpoint detection: identifying malicious processes that are automating interactions with AI apps, monitoring for unusual accessibility service usage (as with PromptSpy), and analyzing local script behavior.
4. The Supply Chain Trust Problem: It exploits the inherent trust placed in first-party applications and services from major vendors, which are typically whitelisted and minimally monitored.

Moving Forward: A New Defense Posture

Combating this threat requires a layered defense strategy that moves beyond network perimeter controls:

• Endpoint Detection and Response (EDR) Enhancement: EDR tools must be tuned to flag processes that programmatically control or interact with AI chatbot applications, especially those leveraging accessibility APIs for purposes other than user assistance.
• User and Entity Behavior Analytics (UEBA): Establishing baselines for normal AI service usage per user can help identify accounts making automated, high-frequency, or logically anomalous queries to chatbots.

Content Inspection: While the network channel is trusted, deeper inspection of the content* being fetched by AI browsing features—looking for encoded or encrypted data patterns in web requests initiated by these services—could provide clues.

• Application Control and Hardening: Restricting the installation of AI chatbot apps on corporate-managed devices, or strictly controlling their permissions (especially accessibility services and web browsing rights), can reduce the attack surface.

Conclusion

The emergence of AI chatbots as malware relays is not a theoretical vulnerability but an active threat, as evidenced by families like PromptSpy. It represents a clever convergence of social engineering (trust in brand-name apps) and technical evasion. For cybersecurity professionals, the message is clear: the attack surface has expanded into the realm of AI-assisted productivity. Defensive strategies must now account for the possibility that some of the most trusted services in the digital ecosystem can be transformed into potent weapons in an attacker's arsenal. Continuous monitoring of endpoint behavior, rather than just network flows, will be paramount in identifying and neutralizing these covert AI-powered command centers.