ESET Analysis<\/p>\n
Menace Studies<\/p>\n<\/div>\n
A view of the H1 2026 risk panorama as seen by ESET telemetry and from the attitude of ESET risk detection and analysis specialists.<\/p>\n
![\"Ji\u0159\u00ed](\"https:\/\/web-assets.esetstatic.com\/tn\/-x45\/wls\/jiri-kropac.jpeg\")
<\/picture><\/a><\/div>\n<\/div>\n\n 08 Jul 2026<\/span> The primary half of 2026 reveals how attackers proceed to enhance the effectivity and scalability of their operations. Fairly than counting on totally new strategies and instruments, they’re shortly adapting established methods to new platforms, applied sciences, and person behaviors.<\/p>\n Synthetic intelligence is taking part in a rising function on this growth. In H1 2026, ESET analyzed almost 900,000 AI abilities \u2013 small useful elements utilized by AI brokers \u2013 and recognized tens of hundreds of suspicious and hundreds of outright malicious cases. The variety of AI abilities inside this new ecosystem is rising quickly \u201cas we converse\u201d, additional increasing the assault floor.<\/p>\n AI can also be starting to seem inside malware itself. Shortly after the emergence of the primary AI-powered ransomware in 2025, ESET researchers recognized PromptSpy, the primary recognized Android malware to make use of generative AI in its execution circulate. The malware leverages AI \u2013 particularly, Google\u2019s Gemini \u2013 to interpret person interface parts and adapt throughout gadgets and environments with out counting on hardcoded conduct. Whereas nonetheless uncommon, PromptSpy illustrates the potential for elevated flexibility in future threats \u2013 though guardrails in opposition to abuse included in LLMs are doubtless slowing down the adoption.<\/p>\n ClickFix \u2013 a social engineering approach leveraging faux error messages \u2013 has expanded past faux CAPTCHA prompts into AI-themed assist pages, browser extensions, and cloud authentication eventualities. ESET detections of this vector greater than doubled between H2 2025 and H1 2026, indicating sustained exercise and adaptation.<\/p>\n Phishing campaigns are additionally evolving in response to person conduct. QR code phishing \u2013 also referred to as quishing \u2013 has reached file ranges in ESET telemetry, with attackers embedding malicious hyperlinks in QR codes to bypass cursory inspection and shift person interplay to cellular gadgets, whereas exploiting the implicit belief many individuals place within the black-and-white squares.<\/p>\n Final however not least, ransomware exercise confirmed no indicators of slowing down, with continued use of EDR killers \u2013 instruments designed to disable safety software program throughout assaults. ESET Analysis has documented over 100 EDR killers used within the wild, with new variants showing commonly. On the identical time, knowledge from a number of sources reveals {that a} declining share of victims are selecting to pay ransoms, suggesting some progress in mitigation and response measures.<\/p>\n
\n \u00a0\u2022\u00a0<\/span>
\n , <\/span>
\n 2 min. learn<\/span>\n <\/p>\n![\"ESET](\"https:\/\/web-assets.esetstatic.com\/tn\/-x266\/wls\/2026\/07-26\/eset-threat-report-h1-2026.jpg\")
<\/picture> <\/div>\n<\/div>\n\n