ESET's H1 2026 Threat Report (covering December 2025 through May 2026) paints a stark picture: attackers are not reinventing the wheel — they are rapidly adapting proven techniques to artificial intelligence platforms, emerging technologies, and shifting user behavior. The report, released July 8, 2026, documents record-breaking quishing activity, a 108% surge in ClickFix attacks, thousands of malicious AI skills in the wild, and the emergence of the first Android malware to use generative AI as part of its runtime execution flow.
Malicious AI Skills: From 600 to 3,000+ in Months
One of the most alarming findings in the report is the explosive growth of malicious AI skills — small functional components used by AI agents that can be shared through repositories and consumed by AI automation frameworks.
Between March and May 2026, ESET analyzed nearly 900,000 AI skills from popular repositories. The results were sobering:
- Unique skills scanned grew from 60,000 to ~900,000 in just two months
- Suspicious skills jumped from ~10,000 to more than 25,000
- Confirmed malicious skills grew from ~600 to over 3,000
Malicious skills discovered in the wild leveraged well-known offensive tools including Mimikatz and Impacket. Others were self-modifying — capable of writing persistence mechanisms to survive across AI agent restarts. Some skills were ostensibly "security" tools that provided a false sense of protection while doing nothing useful.
The full documented capability set includes command execution, file access, third-party tool downloading, credential loading, code injection, and obfuscation. As ESET Malware Analyst Anton Mäčko noted:
"AI skills can enable a wide range of agentic AI abuses, from automated reconnaissance and red-team-style attacks to spam generation, malware modification, and distribution. Adversaries will likely keep testing these approaches to bypass controls, including by obfuscating intent or using region-specific, niche, or constructed languages."
AI-Powered Malware: PromptSpy and PromptLock
PromptSpy — First GenAI-Powered Android Malware
ESET documented PromptSpy, the first confirmed Android malware to use generative AI as part of its core execution flow. Rather than hardcoding screen taps for each target device or app version, PromptSpy calls Google Gemini at runtime to interpret the current screen's UI elements and decide which gestures to execute.
The attack chain works as follows: PromptSpy sends Gemini a chat prompt combined with an XML dump of the current screen — including UI element types, text labels, class names, and coordinates. Gemini responds with JSON-formatted gesture instructions, which the malware executes via Android's Accessibility Service, then loops back for the next instruction.
This architecture makes PromptSpy highly resilient to interface changes across different devices and Android versions without requiring hardcoded interaction logic. The first known sample (then called VNCSpy) appeared on VirusTotal on January 13, 2026, uploaded from Hong Kong. A second version appeared February 10, 2026 from Argentina. ESET has not yet observed PromptSpy in telemetry, suggesting it may still be in development or limited deployment.
PromptLock — AI-Assisted Ransomware
Also documented is PromptLock, an experimental Golang ransomware that uses the Ollama API and the gpt-oss:20b LLM to dynamically generate malicious Lua scripts at runtime. These scripts handle filesystem enumeration, data exfiltration, and encryption using the SPECK 128-bit algorithm. Rather than shipping a static payload, PromptLock generates attack logic on-the-fly — a technique that complicates static analysis and signature-based detection.
ClickFix: 108% Surge and New Variants
ClickFix — the social engineering technique that tricks victims into executing malicious commands by displaying fake CAPTCHA-like prompts — grew 108% between H2 2025 and H1 2026. ESET documented three new variants:
- AI-fix: Abuses user trust in generative AI by embedding ClickFix chains inside AI-generated troubleshooting content for non-existent issues. Attackers spoof domains of real AI companies to heighten credibility.
- CrashFix: Leverages browser extensions and fake browser crash warnings to trigger the copy-paste execution chain.
- ConsentFix: Combines ClickFix-style user interaction with OAuth authorization abuse to hijack cloud accounts — bypassing MFA entirely by abusing the legitimate OAuth consent flow. Detailed instructions for ConsentFix were posted to Russian cybercrime forums as early as March 2026.
Ransomware groups actively using ClickFix for initial access include LeakNet (which uses a Deno runtime loader), Interlock, and Velvet Tempest / DEV-0504 — a group with documented connections to Ryuk, REvil, Conti, BlackMatter, BlackCat/ALPHV, LockBit, and RansomHub.
Quishing Hits Record Levels
QR code phishing (quishing) reached its highest levels ever in ESET telemetry during H1 2026:
- Averaging 100,000 detections per month, peaking in April 2026
- ~11% of all detected phishing emails in the period contained QR codes
- Geographic distribution: United States (19%), Spain (17%), Mexico (6%)
Quishing continues to be an effective evasion technique because QR codes are opaque to email security scanners and shift the attack interaction to mobile devices — which typically have less robust security tooling.
Ransomware: More Tools, Fewer Payments
ESET's report confirms ransomware activity showed no signs of slowing in H1 2026. Researchers now track more than 100 different EDR killer tools actively used in ransomware campaigns to disable security software before encryption begins.
Despite growing attack volume, ransom payment rates have hit all-time lows. Three independent industry reports cited by ESET confirm that only 14–28% of ransomware victims paid during the period — a reflection of improving backup strategies, law enforcement actions, and decryptor availability.
Takeaways for Defenders
ESET's H1 2026 report underscores that the threat landscape in 2026 is defined not by new attack primitives but by adversaries scaling proven techniques through AI automation:
- Audit AI skill sources used in your AI agent workflows — treat third-party skills as untrusted code requiring the same vetting as any dependency
- Deploy ClickFix awareness training covering AI-themed lures, fake crash warnings, and OAuth consent abuse
- Enforce QR code scanning policies and deploy email security controls capable of detecting QR payloads
- Invest in EDR resilience — assume attackers will attempt to kill endpoint security before encrypting; test tamper protection settings
- Maintain tested backups — the declining payment rate shows that recovery capability remains the most effective ransomware countermeasure
The full ESET H1 2026 Threat Report is available at welivesecurity.com.