ESET has uncovered PromptSpy, Android malware that uses Gemini to stay running, spy on devices and make removal attempts more difficult.