A view of the H1 2026 risk panorama as seen by ESET telemetry and from the attitude of ESET risk detection and analysis consultants.
08 Jul 2026
•
,
2 min. learn
The primary half of 2026 reveals how attackers proceed to enhance the effectivity and scalability of their operations. Relatively than counting on completely new strategies and instruments, they’re shortly adapting established methods to new platforms, applied sciences, and consumer behaviors.
Synthetic intelligence is taking part in a rising position on this growth. In H1 2026, ESET analyzed almost 900,000 AI expertise – small practical parts utilized by AI brokers – and recognized tens of 1000’s of suspicious and 1000’s of outright malicious cases. The variety of AI expertise inside this new ecosystem is rising quickly “as we communicate”, additional increasing the assault floor.
AI can also be starting to look inside malware itself. Shortly after the emergence of the primary AI-powered ransomware in 2025, ESET researchers recognized PromptSpy, the primary recognized Android malware to make use of generative AI in its execution stream. The malware leverages AI – particularly, Google’s Gemini – to interpret consumer interface components and adapt throughout gadgets and environments with out counting on hardcoded conduct. Whereas nonetheless uncommon, PromptSpy illustrates the potential for elevated flexibility in future threats – though guardrails towards abuse included in LLMs are doubtless slowing down the adoption.
ClickFix – a social engineering method leveraging faux error messages – has expanded past faux CAPTCHA prompts into AI-themed assist pages, browser extensions, and cloud authentication situations. ESET detections of this vector greater than doubled between H2 2025 and H1 2026, indicating sustained exercise and adaptation.
Phishing campaigns are additionally evolving in response to consumer conduct. QR code phishing – also called quishing – has reached document ranges in ESET telemetry, with attackers embedding malicious hyperlinks in QR codes to bypass cursory inspection and shift consumer interplay to cell gadgets, whereas exploiting the implicit belief many individuals place within the black-and-white squares.
Final however not least, ransomware exercise confirmed no indicators of slowing down, with continued use of EDR killers – instruments designed to disable safety software program throughout assaults. ESET Analysis has documented over 100 EDR killers used within the wild, with new variants showing often. On the similar time, knowledge from a number of sources reveals {that a} declining share of victims are selecting to pay ransoms, suggesting some progress in mitigation and response measures.
Comply with ESET analysis on X, Bluesky and Mastodon for normal updates on key tendencies and prime threats.
To study extra about how risk intelligence can improve the cybersecurity posture of your group, go to the ESET Risk Intelligence web page.
