ESET Reports Surge in Malicious AI Skills and Evolving Cyber Threats

www.welivesecurity.com

ESET Reports Surge in Malicious AI Skills and Evolving Cyber Threats

First seen 8 Jul 2026, 17:25 UTC • •61.3

Article Content

1 / 6

Browse articles

ThreatCluster •July 9, 2026 at 14:42 UTC

•Over 25,000 suspicious AI skills identified, expanding the attack surface.
•PromptSpy is the first Android malware using generative AI for execution.
•ClickFix and QR code phishing tactics have seen significant increases in activity.

ESET's H1 2026 Threat Report reveals significant advancements in cyber threats, particularly through the use of artificial intelligence (AI). An analysis of nearly 900,000 AI skills identified over 25,000 suspicious and thousands of malicious instances, expanding the attack surface. The report highlights PromptSpy, the first known Android malware utilizing generative AI, which adapts its behavior based on user interface elements. Social engineering tactics have evolved, with ClickFix techniques doubling in detection rates, and QR code phishing has reached record levels. Ransomware activity remains high, with over 100 EDR killers documented. The report suggests a shift in user behavior and trust dynamics, complicating detection and response efforts.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 94d ago How this analysis works

Timeline

2026-07-08

ESET releases H1 2026 Threat Report

The report details advancements in cyber threats, including AI-driven attacks and evolving social engineering tactics.

2026-07-08

Discovery of PromptSpy malware

PromptSpy is identified as the first Android malware leveraging generative AI to adapt its behavior.

www.globenewswire.com

2026-07-09

ClickFix detection rates double

ESET reports a doubling in detections of ClickFix, a social engineering technique exploiting trust in AI.

More articles in this cluster (5)

Threat Graph

9 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (6)

Data Breach
Malware
Phishing
Ransomware
T1059 - Command and Scripting Interpreter
T1566 - Phishing

Malware (1)

PromptSpy

Affected Platform (1)

Android

Tool (1)

EDR Killers

Relationships

Data Breach targets Android
Malware targets Android
Phishing targets Android
Ransomware targets Android
T1059 - Command and Scripting Interpreter targets Android
T1566 - Phishing targets Android
PromptSpy related to EDR Killers

Following this threat?

Track PromptSpy in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…