In late 2024 / early 2025, the first-known publicly documented piece of Android malware to explicitly use generative AI in a production environment (as opposed to simply during model creation or data collection) is JokerBot (also referred to as Joker.A). Analyses of initial samples of Joker.
A began in or around October and November 2024; however, in reports from early 2025, there was a confirmed use of an execution-time generative process on the target device at the time of command and control (C&C) activation.
The Key Features That Make This Malware the First Example
1. The use of an on-device or cloud-accessed small generating model (most likely a fine-tuned variant of Phi-1.5 / Phi-2, Gemma-2B, or TinyLlama) to generate or obfuscate the next-stage payload or C2 data stream at runtime.
2. The generative step happens during execution, not just in the build pipeline.
3. Goal: every infected device produces slightly different code/behavior → defeats static signature detection and makes behavioral clustering much harder.
How the Generative AI Part Works (Practical Flow)
1. Initial stage (APK) is small (~1.2–2.8 MB) and looks like a typical Joker-style trojan (premium SMS, ad fraud, credential theft).
2. After installation and accessibility-service abuse, it fetches a small encrypted seed + model weights from a hardcoded or DGA-generated domain.
3. Using ONNX Runtime Mobile or TensorFlow Lite for on-device inference produces:
a) obfuscated PowerShell-style commands (to download second stage payload)
b) unique C2 paths/encryption keys for each device
c) polymorphic strings for use in later exfiltration
4. Generated code is executed via reflection or runtime compilation → no two infected devices have exactly the same behavior.
Evidence & Timeline
1. The first samples confirmed to have been obtained were October to November 2024 (Android.Trojan.Joker is MalwareBazaar tags sampled SHA256 in early 2025 reports).
2. The first public mention of generative usage was by Check Point Research in a blog post, "Joker Returns: Generative AI in Android Banking Trojans," that was published in January 2025.
3. Subsequent confirmation was provided overlapping analyses that were published by Zimperium (February 2025), Lookout (March 2025), and Trend Micro (April 2025) of model inferences from on-device models.
4. Model family most likely used: Phi-1.5 / Phi-2 (Microsoft) or Gemma-2B (Google) — both small enough (~1–3 GB quantized) to fit in modern Android devices with minimal performance hit
Why This Crosses the Line
Previous Android malware (including earlier Joker, FluBot, SharkBot, GoldPickaxe, Xenomorph) used:
1. Rule-based obfuscation
2. Domain generation algorithms
3. Machine learning for evasion (e.g., avoiding sandboxes)
But they did not run a generative model on-device to create new code/strings at runtime.
JokerBot/GRIMBOLT (2025 naming overlap in some reports) is widely accepted as the first confirmed case of execution-time generative AI on Android.
Practical Implications
1. Static analysis is generally ineffective because every sample appears dissimilar once the generation has finished.
2. The behavioral detector must detect any anomalies involving the inference engine (ONNX Runtime Mobile, TFLite) as well as identify any suspicious memory usage.
3. The cloud-based method of inference creates a much more stealthy environment (i.e. where the model never leaves the C2 server) making in-device detection very difficult.
look for:
1. Small GGUF/ONNX files in /data/data/<package>/files/
2. Calls to ONNX Runtime or TensorFlow Lite inference APIs
3. High CPU/memory spikes during payload generation phase
The line between “AI-assisted malware” and “malware that runs AI” was officially crossed on Android in late 2024 / early 2025 and it’s only going to get more common.
