ESET H1 report highlights ClickFix, QR phishing and techniques that disable security tools
ESET's H1 2026 Threat Report observes continuing development of fake error prompts, QR phishing and techniques that disable endpoint protection. Reflecting ESET's telemetry and research perspective, it reminds businesses to address both employee actions and the condition of security agents.
Source Facts
ESET published its first-half report on 8 July, noting that ClickFix had expanded to AI-themed support pages, browser extensions and cloud verification scenarios. QR phishing also reached a new high in its telemetry.
On ransomware, the report continues to examine EDR killers designed to disable security software. ESET says it has recorded more than a hundred related tools, but that count does not mean every business is affected or imply that any particular EDR must fail.
Protection agents that stop reporting should also trigger alerts. Staff need a verification channel when prompted to run repair commands or scan QR codes to log in.
Original sources
ESET Threat Report H1 2026
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationEmergency .NET update supplies a previously omitted fix: check Windows application versions again
Illustration