ESET Threat Report H1 2026: AI-Enabled Malware, Quishing and Ransomware Trends
Summary
ESET's H1 2026 report highlights malicious AI skills, AI-assisted Android malware, rising ClickFix and QR-code phishing, and continued ransomware activity involving tools that disable security software.
Key points
- ESET analyzed nearly 900,000 AI skills and identified tens of thousands as suspicious and thousands as malicious.
- Researchers identified PromptSpy, the first known Android malware to use generative AI—Google Gemini—to interpret interface elements and adapt its behavior.
- ClickFix detections more than doubled from H2 2025 to H1 2026 as the social-engineering technique spread to AI-themed help pages, browser extensions, and cloud authentication scenarios.
- QR-code phishing reached record levels in ESET telemetry, using malicious links to direct victims to mobile devices.
- ESET documented more than 100 EDR killers used in the wild, with new variants appearing regularly.
- Ransomware activity continued, while data from multiple sources indicated a declining share of victims were paying ransoms.
Article Details
- Publisher
- ESET
- Report Period
- H1 2026
- Scope
- ESET research and telemetry covering AI skills, malware, ClickFix, QR code phishing, and ransomware.
- Sample Size
- Nearly 900,000 AI skills analyzed.
- Key Statistics
- Among nearly 900,000 AI skills analyzed in H1 2026, ESET identified tens of thousands of suspicious instances and thousands of malicious instances.
- ESET detections of ClickFix more than doubled from H2 2025 to H1 2026.
- ESET Research has documented over 100 EDR killers used in the wild.
MITRE ATT&CK
Malware
Vendors
ESETIn H1 2026, ESET analyzed nearly 900,000 AI skills – small functional components used by AI agents – and identified tens of thousands of suspicious and thousands of outright malicious instances.GoogleThe malware leverages AI – specifically, Google’s Gemini – to interpret user interface elements and adapt across devices and environments without relying on hardcoded behavior.
Products
AndroidShortly after the emergence of the first AI-powered ransomware in 2025, ESET researchers identified PromptSpy, the first known Android malware to use generative AI in its execution flow.GeminiThe malware leverages AI – specifically, Google’s Gemini – to interpret user interface elements and adapt across devices and environments without relying on hardcoded behavior.