A new report from ESET warns of a massive shift in cybercrime, where attackers are integrating generative AI into malware and exploiting 'AI skills' to bypass traditional security measures.

Key Takeaways

  • Attackers are repurposing established techniques for AI platforms and emerging technologies.
  • PromptSpy has emerged as the first Android malware utilizing Google's Gemini AI.
  • Social engineering tactics like ClickFix and Quishing (QR phishing) have seen record-breaking growth.
  • Ransomware attackers are increasingly using specialized 'EDR killers' to disable security software.

The first half of 2026 has marked a significant evolution in the cyber threat landscape. According to the latest ESET H1 2026 Threat Report, cybercriminals are no longer just inventing new tools; they are masterfully adapting existing techniques to integrate with artificial intelligence and changing user behaviors.

A standout discovery is PromptSpy, identified as the first known Android malware to utilize generative AI in its execution flow. By leveraging Google’s Gemini, this malware can interpret user interface elements and adapt itself across different devices and environments, moving away from rigid, hardcoded behaviors that traditional antivirus software can easily detect.

Read Also:DoorDash Expands Into Digital Gaming, Allowing Users to Purchase Games and Gear in One App

Why This Matters

BozokMedia analysis shows that the rise of 'AI skills'—small functional components used by AI agents—is rapidly expanding the attack surface. As attackers gain the ability to automate sophisticated social engineering and adaptive malware, the window for human-led defense is shrinking.

The integration of generative AI into malware marks a paradigm shift from static threats to dynamic, sentient-like digital predators.

Beyond AI-driven malware, social engineering is hitting new heights. The ClickFix technique, which uses fake error messages to manipulate users, has more than doubled in detection. Simultaneously, Quishing (QR code phishing) has reached record levels as attackers exploit the inherent trust users place in QR codes to bypass mobile security scrutiny.

Comparison: Traditional vs. AI-Driven Attacks

FeatureTraditional AttacksAI-Driven Attacks
AdaptabilityLow (Hardcoded)High (Context-Aware)
Detection DifficultyModerateVery High
ScalabilityManual/ScriptedHighly Automated
Did You Know?: Ransomware attackers are increasingly using 'EDR killers,' which are specialized tools specifically designed to shut down endpoint detection and response software during an intrusion.

Frequently Asked Questions

1. How does PromptSpy work?
It uses generative AI to 'see' and understand the screen, allowing it to behave differently depending on the app or device it is on.

2. What is Quishing?
Quishing is a type of phishing where malicious links are embedded in QR codes, making them harder to spot than standard email links.