AI Integration Reshapes Malicious Tactics

Cybersecurity actors are moving beyond the development of entirely novel attack vectors, instead focusing on the optimization of established techniques for current platforms and user behaviors. According to reports covering the first half of 2026, this evolution is increasingly driven by the integration of artificial intelligence into the offensive toolkit.

Artificial Intelligence in Offensive Operations

In the first half of 2026, analysts identified a significant influx of AI-based functional components, often referred to as AI skills, within the threat landscape. Researchers analyzed nearly 900,000 of these components, uncovering tens of thousands of suspicious instances alongside thousands categorized as outright malicious. These tools are being used to expand the attack surface, with the volume of available AI skills continuing to climb.

The Emergence of Adaptive Android Malware

The application of generative AI within malware itself is no longer theoretical. Following the appearance of AI-powered ransomware in 2025, researchers identified PromptSpy, a notable Android threat. This malware utilizes Google’s Gemini to interpret user interface elements in real time. By doing so, the software can adapt its execution flow to various devices and environments without relying on rigid, hardcoded behaviors.

Growth of ClickFix and Quishing

Social engineering tactics have also undergone a period of adaptation and expansion. The ClickFix technique, which utilizes deceptive error messages to compromise users, has moved beyond simple fake CAPTCHA prompts into more complex scenarios involving browser extensions, AI-themed support pages, and cloud-based authentication flows. Simultaneously, QR code phishing, or quishing, has hit record levels in telemetry data. These campaigns leverage the trust users frequently place in mobile-based authentication to bypass traditional inspection methods.

• Nearly 900,000 AI skills analyzed in H1 2026.
• ClickFix detection rates more than doubled between H2 2025 and H1 2026.
• Over 100 unique EDR killer tools documented by researchers in the wild.

Persistent Challenges in Ransomware Defense

Ransomware campaigns continue to present a persistent threat, characterized by the frequent deployment of EDR killers designed to neutralize security software. Despite the sophistication of these tools, there are indications that the traditional ransom-payment model may be losing efficacy. Data suggests a declining percentage of victims are opting to pay, which could imply a maturing capacity for incident response and mitigation within targeted organizations.

Strategic Implications for Security Posture

The ability of malware to adapt its behavior via generative AI suggests that traditional, signature-based defenses may face increasing pressure to evolve. As attackers utilize these technologies to automate and scale, the shift toward AI-aware threats requires a move away from static security configurations. For organizations, the increasing reliance on social engineering—specifically through trusted mobile interfaces and fake authentication prompts—highlights the necessity of prioritizing user-centric verification over legacy perimeter security. Access the full analysis in the ESET’s H1 2026 Threat Report to understand these trends in depth.