ESET Research has released its H1 2026 Threat Report, outlining threat landscape trends observed between December 2025 and May 2026. The report found attackers are continuing to adapt established techniques to new platforms and technologies, while Artificial Intelligence is playing an increasing role in cyberattacks.
ESET analysed nearly 900,000 AI skills and identified tens of thousands of suspicious instances, including thousands classified as malicious. The company also identified PromptSpy, which it describes as the first known Android malware to use Generative AI as part of its execution process.
“Rather than relying on entirely new methods and tools, attackers are quickly adapting established techniques to new platforms, technologies, and user behaviors. The number of AI skills within this new ecosystem is growing rapidly as we speak, further expanding the attack surface,“ said ESET Director of Threat Prevention Labs Jiří Kropáč. “On the other hand, PromptSpy illustrates the potential for increased flexibility in future threats – although guardrails against abuse included in LLMs are likely slowing down the adoption,” explains Kropáč.
The report also found that ClickFix attacks have expanded beyond fake CAPTCHA prompts into AI-themed websites, browser extensions and cloud authentication scenarios. ESET said detections of ConsentFix attacks more than doubled between H2 2025 and H1 2026.
QR code phishing, or quishing, also increased during the reporting period. Approximately 11% of phishing emails detected by ESET in H1 2026 contained QR codes, with the highest levels recorded in the US, Spain and Mexico.
The report also found ransomware activity continued to increase during H1 2026, while the proportion of victims paying ransoms fell. ESET said it has documented more than 100 different endpoint detection and response (EDR) killers used in attacks.
