ESET Research has published the Threat Report for the first half of 2026, containing data from December 2025 to May 2026. The report highlights how ClickFix, a social engineering technique, has evolved with AI pages, browser extensions and cloud authentication scenarios. Quishing reaches record levels, while almost 900,000 AI skills with thousands of malicious instances were analyzed. AI is also starting to appear in malware and ransomware continues to grow, using EDR killers, tools designed to disable security software during attacks
ESET, a global leader in cybersecurity, has released the H1 2026 Threat Report, which summarizes threat trends detected by ESET telemetry, as well as malicious analyzes from ESET threat detection and research experts, for the period between December 2025 and May 2026. The report shows how attackers continue to improve the efficiency and scalability of their operations. AI is taking on an increasingly important role in this development. ESET analyzed nearly 900,000 AI skills – small functional components used by AI agents – and identified tens of thousands of suspicious instances and thousands of malicious instances. AI has also started to spread within malware: ESET researchers have identified PromptSpy, the first known Android malware that uses generative AI in its execution code.
"Rather than relying on new methods and tools, attackers are rapidly adapting established techniques to new platforms, technologies and user behaviors. The number of AI skills within this new ecosystem is growing rapidly, further expanding the attack surface," says Jiří Kropáč, ESET Director of Threat Prevention Labs. “On the other hand, PromptSpy indicates the potential for greater flexibility in future threats – although the abuse protection measures included in LLMs are probably slowing down their adoption,” explains Kropáč.
AI skills are small add-ons or sets of instructions that tell an AI agent how to perform a specific task, including which services or tools to use and what data to access. The published report details some malicious AI skills using third-party hacking tools such as Mimikatz or Impacket and a suspicious self-modifying skill designed to create a persistence mechanism (JSON file) and a self-modifying tool (Python code). This can lead to unpredictable behavior of the agent or its abuse by an attacker. Finally, there are harmless but problematic skills, such as those presented as security scanners, which create a false sense of security but only implement basic scanning techniques – similar to antivirus tools from the 1990s – or simply check the reliability of hashes, URLs and IP addresses on VirusTotal.
Meanwhile, ClickFix – a social engineering technique that exploits fake error messages – has expanded beyond fake CAPTCHA requests to include AI-focused help pages, browser extensions and cloud authentication scenarios. AI-fix shows how attackers exploit trust in generative AI by embedding ClickFix chains of compromise into AI-generated troubleshooting content related to non-existent issues on pages abusing the AI giants' domains. ConsentFix highlights an evolution towards token theft, combining ClickFix-style interaction with the abuse of OAuth authorization to hijack cloud accounts without the need to steal credentials, often bypassing multi-factor authentication (MFA) and relying entirely on legitimate login workflows. ESET's detections of this carrier more than doubled between H2 2025 and H1 2026, indicating continued activity and adaptation.
Phishing campaigns also evolve in line with user behaviors. QR code phishing – also known as quishing – has reached record levels in ESET telemetry, with attackers embedding malicious links into QR codes to evade checks and shift user interaction to mobile devices, while exploiting the implicit trust many people place in these square-patterned QR codes. Approximately 11% of all phishing emails detected in H1 2026 used QR codes, and phishing threats using QR codes were most prevalent in the United States (19% of detections), Spain (17%) and Mexico (6%).
Finally, ransomware activity has shown no signs of slowing down, with the continued use of EDR Killers – tools that disable security software during attacks. ESET Research has documented over 100 different EDR killers used in real-world environments, with new variants appearing regularly. The number of ransomware attacks continued to grow in the first half of 2026, but the number of victims willing to pay hit historic lows. Three recent industry reports confirmed the downward trend, indicating that the share of victims willing to pay stood between 14% and 28%.
