TECHNOMALIST
Cybercriminals in early 2026 sharpened their focus on adaptability and scale, leveraging existing techniques rather than inventing new ones, according to ESET’s H1 2026 Threat Report. The security firm’s telemetry points to a surge in malicious use of AI, increasingly sophisticated social engineering lures, and persistent ransomware campaigns equipped with tools to disarm defenses.
One dangerous trend is the abuse of AI skills—the modular functions that give AI agents specific capabilities. ESET analyzed nearly 900,000 such skills and flagged tens of thousands as suspicious and thousands as outright malicious. The ecosystem of AI skills is expanding “as we speak,” the report notes, continuously widening the attack surface for defenders.
AI’s role is also becoming direct inside malware. ESET researchers identified PromptSpy, which they call the first known Android malware to employ generative AI in its execution. PromptSpy uses Google’s Gemini model to understand on-screen user interface elements, enabling it to adapt its behavior across different devices and environments without relying on hardcoded instructions. While this type of malware remains rare, it demonstrates how future attacks could gain flexibility. The report suggests that built-in safety guardrails in large language models are probably slowing wider adoption.
Social engineering tricks continue to evolve. A technique known as ClickFix, which lures victims with fake error messages, has moved beyond the familiar fake CAPTCHA screens. ESET observed it spreading to AI-themed help pages, malicious browser extensions, and fake cloud authentication dialogs. Detections of this vector more than doubled between the second half of 2025 and the first half of 2026, signaling ongoing refinement by attackers. Because these fake alerts often mimic legitimate system prompts, they can easily trick users into executing malicious scripts.
Phishing campaigns are also adapting to how people work. QR code phishing—quishing—reached record levels in ESET’s data. Attackers embed harmful links inside QR codes, which helps them slip past cursory email inspection and shifts the user’s interaction to mobile phones, where security controls are often lighter. The technique exploits the widespread, often unearned, trust people place in these black-and-white squares. Since QR codes reveal no URL until scanned, they evade many traditional filters.
Ransomware continued unabated, with attackers routinely deploying so-called EDR killers. These tools are designed to terminate or blind endpoint detection and response software during an intrusion. ESET has documented more than 100 distinct EDR killers used in real attacks, and new variants appear regularly. Despite this, separate data suggests a declining percentage of victims are paying ransoms. This hints at some effectiveness of improved backup strategies, incident response, and broader mitigation measures, though the threat remains severe.
The ESET Threat Report H1 2026 paints a picture of an underground that is polishing rather than reinventing—squeezing more out of proven playbooks with the help of AI and creative social engineering.
See an error? Read our corrections policy or email [email protected].
