ESET H1 2026: ClickFix is now everywhere, and AI-powered malware just got adaptive
ESET published its H1 2026 Threat Report this week, covering six months of telemetry from over 100 million endpoints. Three findings are worth pulling out: ClickFix detections jumped 108% compared to the second half of 2025, PromptSpy became the first Android malware observed using generative AI at runtime for adaptive payloads, and ESET found over 3,000 confirmed malicious instances when scanning 900,000 AI skills across popular repositories. Each of these is a different kind of signal, and together they describe a threat landscape that is getting harder to detect with static tools.
ClickFix: from a browser trick to a cross-platform technique
ClickFix started as a browser-based lure: a fake CAPTCHA or error message instructs users to press a keyboard shortcut and paste a command into their terminal or PowerShell window. It works because it exploits user intent, not a software vulnerability. The user runs the malicious command voluntarily, which bypasses most endpoint controls.
The 108% increase in H1 2026 reflects two things: more threat actors adopting the technique, and the technique being refined for environments beyond browsers. ESET documented ClickFix variants deployed in document viewers, email clients, and enterprise collaboration tools. QR code phishing grew at the same time, with attackers embedding malicious QR codes in the same lure pages to shift the interaction to a mobile device where gateway inspection is weaker.
PromptSpy: the first Android malware running AI at runtime
Every previous AI-assisted malware sample worked by generating payloads at build time. A developer used AI to write better phishing copy or obfuscate shellcode, then shipped the finished malware. PromptSpy is different. When it runs on an infected Android device, it queries an LLM to generate a context-aware lure based on what it observes on that specific device. The lure is unique to each victim. This has two practical consequences. First, static signature detection fails because the payload is never the same. Second, the social engineering quality scales with the AI model, not with the skill of the malware author.
25,000 suspicious AI skills in the wild
ESET scanned 900,000 AI skills from popular repositories and found 25,000 suspicious instances and over 3,000 confirmed malicious. The malicious skills contained known attack tools: Mimikatz and Impacket tooling embedded in skill definitions that would execute when a user ran the skill. This is the supply chain attack surface for AI automation expanding in real time. Most enterprise AI governance policies do not cover third-party skill installation, and most endpoints do not have controls around what AI skills are allowed to execute.
What to do with this information
Three concrete steps. First, review your user awareness training for ClickFix specifically. Most users have not been trained to recognize the keyboard-shortcut execution lure, particularly in non-browser contexts. Second, if your organization deploys AI agents or allows third-party AI skill installation, establish an approved skill registry and treat unapproved skills the same way you would treat unsigned executables. Third, if you run Android device management, add PromptSpy indicators (available in the ESET report) to your mobile threat defense rules.
The H1 2026 picture from ESET is one where attackers are not inventing fundamentally new techniques so much as finding new surfaces for old ones and removing the ceiling on how adaptive their payloads can be. ClickFix works in more places. AI-generated social engineering now adapts to each victim. Those are incremental changes with compounding effects.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss adaptive threat detection for your environment.