A view of the H1 2026 risk panorama as seen by ESET telemetry and from the attitude of ESET risk detection and analysis specialists.
08 Jul 2026
•
,
2 min. learn
The primary half of 2026 reveals how attackers proceed to enhance the effectivity and scalability of their operations. Fairly than counting on totally new strategies and instruments, they’re shortly adapting established methods to new platforms, applied sciences, and person behaviors.
Synthetic intelligence is taking part in a rising function on this growth. In H1 2026, ESET analyzed almost 900,000 AI abilities – small useful elements utilized by AI brokers – and recognized tens of hundreds of suspicious and hundreds of outright malicious cases. The variety of AI abilities inside this new ecosystem is rising quickly “as we converse”, additional increasing the assault floor.
AI can also be starting to seem inside malware itself. Shortly after the emergence of the primary AI-powered ransomware in 2025, ESET researchers recognized PromptSpy, the primary recognized Android malware to make use of generative AI in its execution circulate. The malware leverages AI – particularly, Google’s Gemini – to interpret person interface parts and adapt throughout gadgets and environments with out counting on hardcoded conduct. Whereas nonetheless uncommon, PromptSpy illustrates the potential for elevated flexibility in future threats – though guardrails in opposition to abuse included in LLMs are doubtless slowing down the adoption.
ClickFix – a social engineering approach leveraging faux error messages – has expanded past faux CAPTCHA prompts into AI-themed assist pages, browser extensions, and cloud authentication eventualities. ESET detections of this vector greater than doubled between H2 2025 and H1 2026, indicating sustained exercise and adaptation.
Phishing campaigns are additionally evolving in response to person conduct. QR code phishing – also referred to as quishing – has reached file ranges in ESET telemetry, with attackers embedding malicious hyperlinks in QR codes to bypass cursory inspection and shift person interplay to cellular gadgets, whereas exploiting the implicit belief many individuals place within the black-and-white squares.
Final however not least, ransomware exercise confirmed no indicators of slowing down, with continued use of EDR killers – instruments designed to disable safety software program throughout assaults. ESET Analysis has documented over 100 EDR killers used within the wild, with new variants showing commonly. On the identical time, knowledge from a number of sources reveals {that a} declining share of victims are selecting to pay ransoms, suggesting some progress in mitigation and response measures.
To be taught extra about how risk intelligence can improve the cybersecurity posture of your group, go to the ESET Menace Intelligence web page.
