A view of the H1 2026 menace panorama as seen by ESET telemetry and from the attitude of ESET menace detection and analysis specialists.
08 Jul 2026
•
,
2 min. learn
The primary half of 2026 reveals how attackers proceed to enhance the effectivity and scalability of their operations. Moderately than counting on fully new strategies and instruments, they’re shortly adapting established methods to new platforms, applied sciences, and person behaviors.
Synthetic intelligence is enjoying a rising function on this improvement. In H1 2026, ESET analyzed almost 900,000 AI expertise – small useful elements utilized by AI brokers – and recognized tens of hundreds of suspicious and hundreds of outright malicious cases. The variety of AI expertise inside this new ecosystem is rising quickly “as we communicate”, additional increasing the assault floor.
AI can be starting to look inside malware itself. Shortly after the emergence of the primary AI-powered ransomware in 2025, ESET researchers recognized PromptSpy, the primary identified Android malware to make use of generative AI in its execution movement. The malware leverages AI – particularly, Google’s Gemini – to interpret person interface parts and adapt throughout gadgets and environments with out counting on hardcoded conduct. Whereas nonetheless uncommon, PromptSpy illustrates the potential for elevated flexibility in future threats – though guardrails towards abuse included in LLMs are seemingly slowing down the adoption.
ClickFix – a social engineering method leveraging faux error messages – has expanded past faux CAPTCHA prompts into AI-themed assist pages, browser extensions, and cloud authentication situations. ESET detections of this vector greater than doubled between H2 2025 and H1 2026, indicating sustained exercise and adaptation.
Phishing campaigns are additionally evolving in response to person conduct. QR code phishing – also called quishing – has reached file ranges in ESET telemetry, with attackers embedding malicious hyperlinks in QR codes to bypass cursory inspection and shift person interplay to cell gadgets, whereas exploiting the implicit belief many individuals place within the black-and-white squares.
Final however not least, ransomware exercise confirmed no indicators of slowing down, with continued use of EDR killers – instruments designed to disable safety software program throughout assaults. ESET Analysis has documented over 100 EDR killers used within the wild, with new variants showing commonly. On the similar time, information from a number of sources reveals {that a} declining share of victims are selecting to pay ransoms, suggesting some progress in mitigation and response measures.
Observe ESET analysis on X, Bluesky and Mastodon for normal updates on key traits and prime threats.
To be taught extra about how menace intelligence can improve the cybersecurity posture of your group, go to the ESET Risk Intelligence web page.
