# ESET H1 2026 Threat Report: Malicious AI Agent Skills Surge Fivefold to 3,000+ Entries; PromptSpy Debuts as First Gemini-Powered Android Malware

> ESET's H1 2026 Threat Report (Dec 2025-May 2026 telemetry) documents a fivefold surge in malicious AI agent "skills" between March and May 2026 -- from ~600 to 3,000+ malicious skills out of nearly 900,000 analyzed in public repositories, including skills that bundle credential-dumping and lateral-movement tools like Mimikatz and Impacket. The same report profiles PromptSpy, an advanced VNCSpy-family Android RAT and the first known Android malware to call a generative-AI model (Google's Gemini) at runtime to interpret on-screen UI elements and drive adaptive, device-independent automation.

- **Published:** 2026-07-31T00:00:00Z
- **Last reviewed:** 2026-07-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1798
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-eset-h1-2026-ai-skills-tl-2026-1798.webp?v=5d9dc928 (Threadlinqs threat intel: ESET H1 2026 Threat Report AI Skills: Detection & IOCs (TL-2026-1798) — Medium severity, 26 IOCs, 9 detection rules.)
- **ID:** TL-2026-1798
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 26 (3 shown free below)

## Description

ESET Research's H1 2026 Threat Report, covering telemetry from December 2025 through May 2026, identifies two related but distinct developments in AI-enabled threats. First, ESET's tracking of the emerging AI agent "skill" ecosystem -- small, reusable instruction sets that tell an AI agent which tools, services, or data to use for a task -- found explosive growth in malicious content: unique skills analyzed grew from roughly 60,000 in March 2026 to nearly 900,000 by May 2026, suspicious skills grew from about 10,000 to 25,000, and outright malicious skills grew from about 600 to more than 3,000 over the same three-month window. Malicious skills identified by ESET wrap legitimate offensive-security tooling (Mimikatz for credential dumping, Impacket for lateral movement and remote execution) inside agent-consumable packages, include self-modifying skills that write their own persistence mechanisms (JSON-based) and rewrite their own Python logic, and include deliberately weak or fake "security" skills that create a false sense of protection. Warning-sign behaviors ESET flags across this skill supply chain include command execution, file access, credential loading, code injection, obfuscation, and third-party tool downloading -- capabilities that convert a small, seemingly benign automation add-on into a high-risk software-supply-chain component once an AI agent is granted the ability to browse, execute commands, access files, or reach third-party services.

Second, ESET researcher Lukas Stefanko documented PromptSpy, an advanced evolution of the existing VNCSpy Android RAT family and the first known Android malware to embed a call to a generative-AI model in its execution flow. Rather than relying on hardcoded tap coordinates and UI selectors -- which break across different devices, screen sizes, and app versions -- PromptSpy captures the current screen as an XML dump via Android's Accessibility Service, sends that XML together with a fixed "you are an Android automation assistant" prompt to Google's Gemini API, and receives back structured JSON (status, reasoning, action_type, coordinates) describing exactly which UI action to perform next. The malware then executes that action through the Accessibility Service and repeats the request/response loop until its task -- primarily locking the malicious app persistently into the device's recent-apps list -- is complete. PromptSpy additionally ships a built-in VNC module that gives operators full remote-desktop control of the infected device, can intercept lockscreen PINs/passwords, records the pattern-unlock gesture as video, takes screenshots, and uses invisible screen overlays to block the uninstall button. Samples were distributed outside Google Play via a dropper hosted at mgardownload[.]com that led to a phishing page at m-mgarg[.]com impersonating JPMorgan Chase Bank under the app identity "MorganArg," targeting Argentina-based users; the VNC module communicates with a hardcoded C2 host at 54.67.2[.]84. Debug strings and localized event handlers in Simplified Chinese indicate the malware was built in a Chinese-speaking development environment. ESET disclosed the findings to Google prior to publication; Google states no PromptSpy samples were found on Google Play and that Play Protect blocks known versions by default. As of publication, PromptSpy had not been observed in live ESET telemetry, indicating it remains at proof-of-concept / limited-test-campaign stage rather than a widely deployed threat -- but ESET assesses it as a preview of where AI-agent-integrated mobile malware is heading as LLM guardrails are the main current brake on broader adoption.

The same H1 2026 report places both findings in the context of a broader AI-accelerated threat landscape: ClickFix-style fake-error social engineering (detections up 108% H2 2025-H1 2026, now spanning AI-themed help pages, browser extensions/CrashFix, and OAuth-token-theft ConsentFix variants), record levels of QR-code phishing (quishing), and over 100 tracked EDR-killer tool variants (60+ of them BYOVD, abusing 40+ distinct vulnerable drivers). No CVE applies to this entry -- it is a threat-trend and novel-TTP report rather than a discrete vulnerability disclosure -- but it documents a newly emerging, rapidly growing attack surface (the AI agent skill supply chain) and a first-of-its-kind adaptive-malware technique (LLM-in-the-loop UI automation) that both warrant SOC awareness and detection engineering now, ahead of wider adoption.

## MITRE ATT&CK

- T1476 Deliver Malicious App via Other Means
- T1660 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1541 Foreground Persistence
- T1398 Boot or Logon Initialization Scripts
- T1628 Hide Artifacts
- T1027 Obfuscated Files or Information
- T1417 Input Capture
- T1003 OS Credential Dumping
- T1426 System Information Discovery
- T1570 Lateral Tool Transfer
- T1512 Video Capture
- T1513 Screen Capture
- T1219 Remote Access Tools
- T1521 Encrypted Channel
- T1646 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Self-Modifying AI Skill Persistence + Obfuscated Credential-Dump/Lateral-Movement Tool Invocation (Splunk)** (`TL-2026-1798-SPL-002`)

Detects the post-exploitation stage of the ESET H1 2026 malicious-skill pattern: an AI-agent skill process rewriting its own manifest/config JSON at runtime (self-modifying persistence), combined with base64-obfuscated PowerShell (-EncodedCommand) or Unix-shell (base64 | bash) execution, and/or direct invocation of bundled Mimikatz/Impacket-style tooling (sekurlsa, wmiexec, secretsdump keywords) -- the point where a skill escalates from automation add-on to credential-dumping/lateral-movement implant.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1027, T1059.001, T1003, T1570
- **Data sources:** sysmon, windows_security, edr_process_creation
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(
  (EventCode=11 TargetFilename="*skill_manifest.json")
  OR
  (EventCode=1 Image="*\\powershell.exe" (CommandLine="*-EncodedCommand*" OR CommandLine="*-enc *"))
  OR
  (EventCode=1 (CommandLine="*sekurlsa*" OR CommandLine="*mimikatz*" OR CommandLine="*wmiexec*" OR CommandLine="*secretsdump*"))
)
| eval mitre=case(
    match(CommandLine,"(?i)sekurlsa|mimikatz"),"T1003",
    match(CommandLine,"(?i)wmiexec|secretsdump"),"T1570",
    match(CommandLine,"(?i)EncodedCommand|-enc "),"T1059.001,T1027",
    isnotnull(TargetFilename),"T1541,T1398,T1628 (self-modifying persistence)")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, Image, CommandLine, TargetFilename, mitre
| where count > 0
| sort -last_seen
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("-EncodedCommand", "-enc "))
    or ProcessCommandLine has_any ("sekurlsa", "mimikatz", "wmiexec", "secretsdump")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend DetectionReason = "Obfuscated command execution or bundled credential-dump/lateral-movement tool invocation"
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "skill_manifest.json" and isnotempty(PreviousFileName)
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath
    | extend DetectionReason = "AI-agent skill self-modified its own manifest at runtime"
)
| order by Timestamp desc
```

### Sigma

```yaml
title: Malicious AI Skill Self-Modification + Obfuscated Credential-Dump/Lateral-Movement Tool Invocation
id: 8f2b6e2a-1798-4b8e-9f01-a1b2c3d4e5f2
status: experimental
description: Detects base64-obfuscated PowerShell/shell execution or direct invocation of Mimikatz/Impacket-style tooling, optionally correlated with a process previously observed writing an AI-agent skill manifest -- the post-exploitation stage of the ESET H1 2026 malicious-skill pattern.
references:
    - https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-31
tags:
    - attack.credential-access
    - attack.lateral-movement
    - attack.defense-evasion
    - attack.persistence
    - attack.t1003
    - attack.t1570
    - attack.t1059.001
    - attack.t1027
    - attack.t1541
    - attack.t1398
    - attack.t1628
    - attack.tool.mimikatz
    - attack.tool.impacket
    - eset.h1-2026.ai-agent-skill
logsource:
    category: process_creation
    product: windows
detection:
    sel_encoded:
        Image|endswith: '\powershell.exe'
        CommandLine|contains: '-EncodedCommand'
    sel_tooling:
        CommandLine|contains:
            - 'sekurlsa'
            - 'mimikatz'
            - 'wmiexec'
            - 'secretsdump'
    condition: sel_encoded or sel_tooling
falsepositives:
    - Legitimate scheduled/CI automation using base64-EncodedCommand PowerShell
    - Authorized red-team/pentest use of Mimikatz or Impacket under signed change-control ticket
level: high
```

**Known false positives:**

- Legitimate scheduled/CI automation using base64-EncodedCommand PowerShell
- Authorized red-team/pentest use of Mimikatz or Impacket under signed change-control ticket

**Tuning notes:** Baseline legitimate EncodedCommand usage from RMM/patch-management tooling and exclude those signed binaries by publisher hash; escalate to critical severity only when the tooling-keyword match (sekurlsa/mimikatz/wmiexec/secretsdump) co-occurs with the self-modified-manifest event within a short time window.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Malicious AI-Agent Skill Manifest Delivery & PromptSpy Dropper/Phishing Infrastructure Contact (Sentinel) (locked: unlock with TL Creds)
- Self-Modifying AI Skill Persistence + Obfuscated Credential-Dump/Lateral-Movement Tool Invocation (Sentinel) (locked: unlock with TL Creds)
- PromptSpy Gemini-in-the-Loop UI Automation Beacon + VNC C2/Known-IOC Callback (Sentinel) (locked: unlock with TL Creds)
- Malicious AI Agent Skill Manifest Declaring Dangerous Capability Set (Sigma) (locked: unlock with TL Creds)
- Malicious AI Skill Self-Modification + Obfuscated Credential-Dump/Lateral-Movement Tool Invocation (Sigma) (locked: unlock with TL Creds)
- PromptSpy VNC C2 / Dropper / Phishing Infrastructure Contact (Sigma) (locked: unlock with TL Creds)
- Malicious AI-Agent Skill Manifest Delivery & PromptSpy Dropper/Phishing Infrastructure Contact (Splunk) (locked: unlock with TL Creds)
- PromptSpy Gemini-in-the-Loop UI Automation Beacon + VNC C2/Known-IOC Callback (Splunk) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 26)

Defanged, TLP:CLEAR.

- IP address: `54.67.2[.]84`
- Domain: `mgardownload[.]com`
- File hash: `6BBC9AB132BA066F63676E05DA13D108598BC29B`

Full set of 26 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ESET tracks rise in malicious AI skills and adaptable malware](https://www.bleepingcomputer.com/news/security/eset-tracks-rise-in-malicious-ai-skills-and-adaptable-malware/)
- [ESET Threat Report H1 2026](https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2026/)
- [ESET Threat Report H1 2026 (full PDF)](https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12026.pdf)
- [PromptSpy ushers in the era of Android threats using GenAI](https://www.welivesecurity.com/en/eset-research/promptspy-ushers-in-era-android-threats-using-genai/)
- [ESET Research discovers PromptSpy, the first Android threat to use generative AI](https://www.eset.com/us/about/newsroom/research/eset-research-discovers-promptspy-first-android-threat-using-genai/)
- [PromptSpy is the first known Android malware to use generative AI at runtime](https://www.bleepingcomputer.com/news/security/promptspy-is-the-first-known-android-malware-to-use-generative-ai-at-runtime/)
- [PromptSpy Android Malware Abuses Gemini AI to Automate Recent-Apps Persistence](https://thehackernews.com/2026/02/promptspy-android-malware-abuses-google.html)
- [PromptSpy Android Malware Abuses Gemini AI at Runtime for Persistence](https://www.securityweek.com/promptspy-android-malware-abuses-gemini-ai-at-runtime-for-persistence/)
- [PromptSpy abuses Gemini AI to gain persistent access on Android](https://securityaffairs.com/188261/ai/promptspy-abuses-gemini-ai-to-gain-persistent-access-on-android.html)
- [Android malware is now using Gemini AI to adapt in real time (Updated: Google statement)](https://www.androidauthority.com/android-malware-promptspy-uses-generative-ai-gemini-3642832/)
- [Android malware taps Gemini to navigate infected devices](https://www.theregister.com/2026/02/19/genai_malware_android/)
- [Thousands of malicious AI skills found capable of stealing data, running malware](https://www.helpnetsecurity.com/2026/07/08/eset-ai-threat-trends-report/)
- [ESET Threat Report H1 2026 Highlights Malicious AI Skills, ClickFix Surge, and EDR Killers](https://gbhackers.com/eset-threat-report-h1-2026/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1798