In the first half of 2026, attackers have increasingly integrated AI into their operations, adapting existing attack methods to new platforms and user behaviors. ESET analyzed nearly 900,000 AI skills, identifying thousands of malicious instances, indicating rapid growth of this attack surface. AI-assisted malware like PromptSpy uses generative AI to dynamically interpret user interfaces and adapt across devices. Social engineering techniques such as ClickFix have evolved beyond fake CAPTCHAs to AI-themed help pages and cloud authentication scams. QR code phishing has surged, exploiting user trust in QR codes. Ransomware activity continues with frequent use of EDR killers to disable security software. Despite these advances, fewer victims are paying ransoms, suggesting some mitigation progress.

The integration of AI into malware and attack techniques increases the adaptability and scalability of cyber threats, potentially making detection and prevention more challenging. The rise of AI-assisted malware like PromptSpy can evade traditional static defenses by dynamically adapting to environments. Expanded social engineering tactics and increased quishing attacks raise the risk of successful user-targeted compromises. Continued use of EDR killers in ransomware attacks threatens endpoint security by disabling protective software. However, a decline in ransom payments may reduce attacker incentives and impact.

No specific patch or official fix is applicable as this is a broad trend rather than a single vulnerability. Organizations should remain aware of evolving AI-assisted threats and social engineering tactics described by ESET. Monitoring for suspicious AI skill usage and emerging malware variants is advised. Since ransomware with EDR killers remains active, maintaining updated endpoint detection and response capabilities and applying best practices for ransomware defense remain important. Check ESET's official threat report for detailed guidance and updates.