ESET H1 2026 Threat Report Finds Rising ClickFix, QR Phishing and Malicious AI Skills
Report discovered via Awesome Annual Security Reports.
Summary
ESET’s H1 2026 report found over 3,000 malicious AI skills among nearly 900,000 scanned, a 108% rise in ClickFix detections and growing QR phishing. It also examines PromptSpy’s Gemini use and tools that disable endpoint defenses.
Key points
- Covering December 2025–May 2026, the report draws on ESET’s global telemetry to examine threat trends across platforms.
- ESET scanned nearly 900,000 AI skills, identifying over 25,000 as suspicious and over 3,000 as malicious; risks included credential access, data exfiltration and malicious code execution.
- ClickFix detections increased 108% from H2 2025. Variants included AI-branded troubleshooting lures, CrashFix browser-extension prompts and ConsentFix theft of Microsoft OAuth authorization codes.
- QR codes appeared in approximately 11% of phishing emails detected by ESET, averaging 100,000 detections monthly and peaking in April; scanning can move victims onto unmanaged mobile devices.
- PromptSpy uses Gemini to interpret Android interface elements and guide persistence gestures. ESET recorded one detection, leaving the scale of real-world deployment unclear.
- ESET tracks over 100 EDR-disabling tools used in the wild, including over 60 that abuse more than 40 vulnerable drivers; ransomware actors sometimes deploy multiple tools together.
- Research into Gentlemen’s EDR-killer suite found shared security-vendor impersonation techniques and rapid adoption of newly disclosed vulnerable-driver proofs of concept.
Article Details
- Publisher
- ESET
- Report Period
- December 2025–May 2026 (H1 2026)
- Scope
- Global ESET threat telemetry and research covering AI skills, ClickFix, QR code phishing, Android malware, ransomware, and EDR killers.
- Sample Size
- Approximately 900,000 AI skills analyzed; overall telemetry sample size not disclosed.
- Key Statistics
- Of approximately 900,000 AI skills analyzed, ESET classified over 25,000 as suspicious and over 3,000 as malicious.
- HTML/FakeCaptcha detections associated with ClickFix increased by 108% between H2 2025 and H1 2026; other attack stages have separate detections.
- QR codes appeared in approximately 11% of phishing emails detected by ESET in H1 2026, averaging 100,000 detections monthly.
- ESET documented over 100 EDR killers used in the wild, including over 60 BYOVD-based killers abusing more than 40 drivers.
- ESET recorded exactly one PromptSpy detection after its initial research publication, on 2026-02-22 in Ukraine; the earlier absence of detections had raised the possibility that it was a proof of concept.
- Recommendations
- Use multilayered email security capable of detecting malicious QR codes.
- Protect Android devices with a reputable security solution.
- Assess suspicious messages before scanning QR codes and inspect the displayed destination link before proceeding.
- Verify questionable messages with the supposed sender through a separate channel, such as chat or telephone.
- Remove PromptSpy by restarting the affected device in safe mode and uninstalling the malicious app through Settings.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mgardownload[.]com | Dedicated distribution website for PromptSpy impersonating the Argentinian branch of JPMorgan Chase Bank; offline at the time of analysis. |
MITRE ATT&CK
T1059.001 · PowerShellClickFix attack stages include copied PowerShell commands or scripts.T1113 · Screen CapturePromptSpy can take screenshots on demand from compromised Android devices.T1125 · Video CapturePromptSpy can record video on compromised devices.T1204.002 · Malicious FileClickFix prompts trick victims into executing malicious commands or scripts presented as fixes.T1219 · Remote Access ToolsPromptSpy deploys a built-in VNC module that provides attackers with real-time remote viewing and control.T1486 · Data Encrypted for ImpactGentlemen uses encryptors as part of its double-extortion ransomware operations.T1528 · Steal Application Access TokenConsentFix tricks victims into pasting URLs containing OAuth authorization codes into phishing pages, enabling account access.T1562.001 · Disable or Modify ToolsRansomware operators deploy EDR killers to terminate, freeze, or blind endpoint security software.
People
Anatoly KravchukIdentified by German authorities as an alleged head of REvil and GandCrab.Anton MäčkoESET Malware Analyst providing commentary on agentic AI skill abuse.Daniil ShchukinIdentified by German authorities as an alleged head of REvil and GandCrab.Dariusz IwańskiESET Senior Detection Engineer explaining QR code phishing detection gaps.Jakub SoučekESET Senior Malware Researcher discussing Gentlemen's proprietary EDR killers and leaked internal data.Jiří KropáčESET Director of Threat Prevention Labs and author of the foreword.Lukáš ŠtefankoESET Senior Malware Researcher commenting on runtime AI integration in malware.Ondrej KubovičESET Security Awareness Specialist commenting on ClickFix social engineering.
Threat Actors
0APTThreat actor reported to have breached Krybit and publicly leaked its panel database.Black BastaRansomware gang reported to have shut down shortly after an internal leak.DragonForceReported to have taken down competing RaaS operator RansomHub the preceding year.GentlemenRaaS gang using double extortion and maintaining proprietary GentleKiller variants; internal material leaked in H1 2026.KimsukyNorth Korea-aligned APT group whose use of QR codes in attacks prompted an FBI alert in January 2026.KrybitRaaS operator that reportedly counter-hacked 0APT, defaced its leak site, and claimed to exfiltrate its operational history.RansomHubRaaS operator reportedly taken down by DragonForce.REvilGerman authorities identified alleged leaders and linked their activities to German extortion cases.WarlockGang linked to EDR killer samples showing signs of AI-generated code.
Malware
NexShield – Smart Ad BlockerThis was the case with the malicious extension NexShield – Smart Ad Blocker, a copycat of the legitimate uBlock Origin Lite.NGateFor an Android-specific example, in April 2026 we reported on an NGate variant that had LLM-style emoji left in the code.PromptLockNot long after discovering PromptLock, the first AI-powered ransomware, ESET researchers found another threat with AI integration, this time developed for Android – PromptSpy.PromptSpy- [PromptSpy: The first AI-powered Android malware](#promptspy-the-first-ai-powered-android-malware)
Vendors
GoogleThe malware leverages AI – specifically, Google’s Gemini – to interpret user interface elements and adapt across devices and environments without relying on hardcoded behavior.MicrosoftAttackers craft pages that abuse legitimate domains – for example, Anthropic’s Artifact pages, OpenAI’s Canvas, or Microsoft’s Copilot Pages – offering troubleshooting content for nonexistent issues.
Products
Android- [PromptSpy: The first AI-powered Android malware](#promptspy-the-first-ai-powered-android-malware)GeminiThe malware leverages AI – specifically, Google’s Gemini – to interpret user interface elements and adapt across devices and environments without relying on hardcoded behavior.Hermes AgentThis shift from conversational AI to autonomous, tool-using agents – popularized by projects such as OpenClaw and Hermes Agent – has created a new and rapidly expanding attack surface.LinuxThe gang relies on double extortion and reportedly offers affiliates a generous 90% revenue share, with ransomware variants targeting Windows, Linux, and other platforms.macOSIn H1 2026, ClickFix continued to spread across new environments and leverage new lures: extending to macOS through commands that supposedly install system utilities, compromising WordPress sites to show ClickFix-styleMicrosoft WindowsThe gang relies on double extortion and reportedly offers affiliates a generous 90% revenue share, with ransomware variants targeting Windows, Linux, and other platforms.OpenClawThis shift from conversational AI to autonomous, tool-using agents – popularized by projects such as OpenClaw and Hermes Agent – has created a new and rapidly expanding attack surface.WordPressnew lures: extending to macOS through commands that supposedly install system utilities, compromising WordPress sites to show ClickFix-style prompts to site administrators, and launching AI-themed waves.
Tools
BloodHoundThe instructions for the agent include the use of external offensive security platforms and tools such as Impacket, Mimikatz, or BloodHound, frequently observed in ransomware and infostealer attacks.ESET AI Skills CheckerSome skills seen by ESET AI Skills Checker only act as local applications that reach out to online scanning services such as VirusTotal, checking hashes, URLs, or IP addresses against known reputational data.GentleKillerAside from encryptors, the gang also maintains a large set of EDR killers, including many variants of GentleKiller – our name for Gentlemen’s proprietary tool of this kind – as well as third-party EDR killers repurposedImpacketThe instructions for the agent include the use of external offensive security platforms and tools such as Impacket, Mimikatz, or BloodHound, frequently observed in ransomware and infostealer attacks.MimikatzThe instructions for the agent include the use of external offensive security platforms and tools such as Impacket, Mimikatz, or BloodHound, frequently observed in ransomware and infostealer attacks.
Countries
FranceCountries reporting the highest volume of detections in ESET telemetry in H1 2026 are Japan (14%), Slovakia (7%), and France, Spain and Peru (each over 5%).JapanCountries reporting the highest volume of detections in ESET telemetry in H1 2026 are Japan (14%), Slovakia (7%), and France, Spain and Peru (each over 5%).MexicoIn H1 2026, `QRCode/Phishing` threats were most prevalent in the US (19% of detections), Spain (17%), and Mexico (6%); we also saw notable activity in the UK (5%), Czechia, Canada, Poland, and Italy (3% each).North KoreaAs a result, the FBI issued a cyber alert in January 2026 to warn of the use of QR codes in campaigns by the North Korea-aligned APT group Kimsuky.PeruCountries reporting the highest volume of detections in ESET telemetry in H1 2026 are Japan (14%), Slovakia (7%), and France, Spain and Peru (each over 5%).SlovakiaCountries reporting the highest volume of detections in ESET telemetry in H1 2026 are Japan (14%), Slovakia (7%), and France, Spain and Peru (each over 5%).SpainCountries reporting the highest volume of detections in ESET telemetry in H1 2026 are Japan (14%), Slovakia (7%), and France, Spain and Peru (each over 5%).UkraineSince the publication of the blogpost, our telemetry has registered exactly one detection of PromptSpy, caught on February 22, 2026 in Ukraine.United KingdomIn H1 2026, `QRCode/Phishing` threats were most prevalent in the US (19% of detections), Spain (17%), and Mexico (6%); we also saw notable activity in the UK (5%), Czechia, Canada, Poland, and Italy (3% each).United StatesIn H1 2026, `QRCode/Phishing` threats were most prevalent in the US (19% of detections), Spain (17%), and Mexico (6%); we also saw notable activity in the UK (5%), Czechia, Canada, Poland, and Italy (3% each).