A view of the H1 2026 risk panorama as seen by ESET telemetry and from the angle of ESET risk detection and analysis specialists.
08 Jul 2026
•
,
2 min. learn
The primary half of 2026 exhibits how attackers proceed to enhance the effectivity and scalability of their operations. Reasonably than counting on fully new strategies and instruments, they’re rapidly adapting established methods to new platforms, applied sciences, and person behaviors.
Synthetic intelligence is enjoying a rising function on this improvement. In H1 2026, ESET analyzed practically 900,000 AI abilities – small useful elements utilized by AI brokers – and recognized tens of hundreds of suspicious and hundreds of outright malicious cases. The variety of AI abilities inside this new ecosystem is rising quickly “as we communicate”, additional increasing the assault floor.
AI can also be starting to seem inside malware itself. Shortly after the emergence of the primary AI-powered ransomware in 2025, ESET researchers recognized PromptSpy, the primary recognized Android malware to make use of generative AI in its execution movement. The malware leverages AI – particularly, Google’s Gemini – to interpret person interface components and adapt throughout units and environments with out counting on hardcoded habits. Whereas nonetheless uncommon, PromptSpy illustrates the potential for elevated flexibility in future threats – though guardrails towards abuse included in LLMs are probably slowing down the adoption.
ClickFix – a social engineering approach leveraging pretend error messages – has expanded past pretend CAPTCHA prompts into AI-themed assist pages, browser extensions, and cloud authentication situations. ESET detections of this vector greater than doubled between H2 2025 and H1 2026, indicating sustained exercise and adaptation.
Phishing campaigns are additionally evolving in response to person habits. QR code phishing – often known as quishing – has reached file ranges in ESET telemetry, with attackers embedding malicious hyperlinks in QR codes to bypass cursory inspection and shift person interplay to cellular units, whereas exploiting the implicit belief many individuals place within the black-and-white squares.
Final however not least, ransomware exercise confirmed no indicators of slowing down, with continued use of EDR killers – instruments designed to disable safety software program throughout assaults. ESET Analysis has documented over 100 EDR killers used within the wild, with new variants showing repeatedly. On the identical time, knowledge from a number of sources exhibits {that a} declining share of victims are selecting to pay ransoms, suggesting some progress in mitigation and response measures.
Comply with ESET analysis on X, Bluesky and Mastodon for normal updates on key developments and prime threats.
To study extra about how risk intelligence can improve the cybersecurity posture of your group, go to the ESET Risk Intelligence web page.
