ESET Threat Report H1 2026
ESET's H1 2026 Threat Report highlights attackers adapting established techniques to new platforms rather than inventing entirely new methods. Key trends include the emergence of PromptSpy (first Android malware using generative AI in its execution flow), the rapid expansion of malicious AI skills, doubling of ClickFix social engineering detections, record-level QR code phishing (quishing), and continued proliferation of EDR killers alongside declining ransom payment rates.
Detection / Hunteropenrouter
What Happened
ESET's report for the first half of 2026 shows that attackers are getting better at scaling their operations by adapting known techniques to new technologies rather than inventing entirely new methods. They identified the first Android malware (called PromptSpy) that uses artificial intelligence to adapt itself to different devices, and found thousands of malicious 'AI skills' — small programs that extend AI assistants. A social engineering trick called ClickFix, which uses fake error messages to trick people into running malicious code, more than doubled in detections. Phishing attacks using QR codes also hit record levels. On the ransomware front, attackers continue to use tools that disable security software, but fewer victims are paying ransoms. Organizations should educate employees about QR code phishing and fake error messages, evaluate their mobile security posture, and ensure endpoint protection tools are resistant to being disabled.
Key Takeaways
- ESET analyzed nearly 900,000 AI skills (functional components for AI agents), identifying tens of thousands of suspicious and thousands of outright malicious instances, signaling a rapidly expanding attack surface.
- PromptSpy is the first known Android malware to use generative AI (Google Gemini) in its execution flow, adapting to UI elements across devices without hardcoded behavior.
- ClickFix social engineering technique more than doubled in detections between H2 2025 and H1 2026, expanding beyond fake CAPTCHAs into AI-themed help pages, browser extensions, and cloud authentication scenarios.
- QR code phishing (quishing) reached record levels in ESET telemetry, with attackers exploiting implicit user trust and shifting interaction to mobile devices.
- Over 100 EDR killers have been documented in the wild by ESET Research, while a declining share of ransomware victims are paying ransoms.
Affected Systems
- Android devices (PromptSpy malware)
- Windows endpoints (EDR killers, ransomware)
- Mobile devices (quishing targets)
- AI agent ecosystems (malicious AI skills)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Reconnaissance: Attackers identify new platforms and user behaviors to target (AI agent ecosystems, mobile devices, cloud authentication flows)
- Initial Access: Social engineering via ClickFix fake error messages, QR code phishing (quishing), or malicious AI skills delivered to AI agent platforms
- Execution: PromptSpy leverages generative AI (Google Gemini) to interpret UI elements and dynamically adapt execution across Android devices
- Defense Evasion: EDR killers deployed to disable security software on Windows endpoints during ransomware operations
- Impact: Ransomware deployment with data encryption and extortion, though declining victim payment rates suggest improved mitigation
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules, queries, or signatures are provided in this article. It is a high-level threat trend report summarizing H1 2026 findings. The full report linked from the article may contain additional technical details.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR killers are explicitly called out as a major trend with 100+ variants in the wild, suggesting some EDR solutions are being successfully targeted. PromptSpy's AI-driven adaptive behavior on Android may evade signature-based detection. However, behavioral EDR telemetry could still capture anomalous process activity. |
| Network Visibility | Medium | QR code phishing and ClickFix rely on redirecting users to malicious infrastructure, which network monitoring could partially detect. However, AI skill abuse and Gemini API calls from PromptSpy may blend with legitimate AI service traffic. |
| Detection Difficulty | Hard | PromptSpy's use of generative AI to dynamically adapt its behavior without hardcoded patterns makes traditional signature-based detection very difficult. ClickFix and quishing rely on social engineering rather than technical exploits, requiring user behavior monitoring and URL reputation analysis. EDR killers are specifically designed to evade or disable endpoint detection tools. |
Required Log Sources
- EDR process creation and termination logs
- Web proxy and DNS logs for phishing redirect detection
- Mobile device management (MDM) telemetry for Android threats
- Email gateway logs for QR code phishing detection
- AI agent platform audit logs for malicious skill identification
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for processes attempting to modify or disable security software services or registry keys associated with EDR solutions, consistent with T1562.001 behavior. | EDR process telemetry, Windows Event Logs (System, Application, Security), service control manager events | Defense Evasion | Medium — legitimate IT administration tools and security software updates may trigger similar patterns. |
| If you have visibility into mobile device telemetry, consider hunting for Android applications making unexpected calls to generative AI APIs (e.g., Gemini) combined with UI automation or accessibility service usage. | MDM logs, mobile threat defense telemetry, network proxy logs for AI API endpoints | Execution | Medium — legitimate AI-integrated applications may also call these APIs; correlate with accessibility service abuse or unusual screen interaction patterns. |
| Consider hunting for QR codes in email bodies or documents that redirect to domains with low reputation scores or newly registered domains, as quishing attacks are at record levels. | Email security gateway logs, web proxy logs, DNS resolution logs | Initial Access | Low to Medium — legitimate QR codes in marketing emails may trigger; focus on combinations of QR image attachments plus suspicious redirect domains. |
| Consider hunting for browser extensions or help pages that present fake error messages prompting users to copy and execute commands or scripts, consistent with ClickFix technique. | Web proxy logs, browser extension inventory logs, endpoint execution logs for script interpreters launched from browser context | Initial Access | Low — legitimate error pages rarely instruct users to execute scripts or commands directly. |
Control Gaps
- Signature-based antivirus and EDR may not detect AI-adaptive malware like PromptSpy that lacks hardcoded behavioral patterns
- Email gateways without QR code image analysis capabilities will miss quishing attacks
- Network security tools may not distinguish legitimate AI API calls from malicious use of generative AI services
- AI agent platforms may lack robust vetting mechanisms for third-party skills, allowing malicious components to be distributed
Key Behavioral Indicators
- Processes attempting to stop, disable, or modify security software services or drivers
- Android applications requesting accessibility services combined with network calls to generative AI APIs
- Email messages containing QR code images that resolve to suspicious URLs
- Browser extensions or web pages presenting fake error dialogs instructing users to execute scripts
- Script interpreters (PowerShell, cmd.exe, bash) spawned from browser processes following user interaction with error messages
False Positive Assessment
Medium — Behavioral detections for EDR killer activity, AI API calls from mobile devices, and QR code phishing all have legitimate analogues. EDR tampering alerts may overlap with IT administration activities, AI API calls may originate from legitimate AI-integrated applications, and QR codes appear in legitimate marketing communications. Correlation with additional context (accessibility service abuse, suspicious redirect domains, script execution from browser context) is recommended to reduce false positives.
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing recent phishing detections for QR code-based attacks (quishing) and ClickFix-style fake error messages, as both are at elevated levels.
- If your email security gateway supports QR code image analysis, consider enabling or verifying that feature is active to detect quishing attempts.
- Consider auditing installed browser extensions across the organization for any that present fake error messages or prompt script execution.
Infrastructure Hardening
- Evaluate whether your EDR solution supports tamper protection or self-defense mechanisms to resist EDR killers, as over 100 variants have been documented in the wild.
- Consider implementing network-based controls to monitor and restrict unauthorized calls to generative AI APIs from endpoints, if supported by your web proxy or firewall.
- If applicable, evaluate AI agent platform governance policies to restrict installation of unvetted third-party AI skills.
User Protection
- Consider deploying mobile threat defense solutions on Android devices if not already in place, given the emergence of AI-adaptive malware like PromptSpy.
- Evaluate whether MDM policies can restrict installation of applications from untrusted sources on managed Android devices.
- Consider enabling enhanced phishing protection features in email security tooling that can analyze embedded images for QR codes.
Security Awareness
- Consider incorporating QR code phishing (quishing) awareness into existing security awareness training, emphasizing that QR codes in emails should be treated with the same caution as links.
- Consider adding ClickFix-style social engineering to awareness programs — train users to be suspicious of web pages or extensions that display error messages instructing them to copy, paste, or execute commands.
- If applicable to your workforce, consider educating users on the risks of installing unvetted AI skills or extensions for AI agent platforms.
