Phishing, quishing and ransomware remain the most severe threats to African companies, including those in SA, as cyber criminals harness AI to improve both the efficiency and scale of their attacks.
This is according to ESET, which presented its H1 2026 Threat Report (December 2025 – May 2026) during a webinar on 12 August.
The findings show that attackers are rapidly adapting established techniques to new platforms and user behaviours, with AI serving as an effective channel for campaigns. Among the emerging threats is PromptSpy, the first known Android malware to incorporate generative AI into its execution flow.
SA a prime target
According to ESET’s global telemetry, phishing accounts for 29.9% of threats targeting Africa. In SA alone, that figure jumps to 45.4%.
Tony Anscombe, chief security evangelist at ESET, said SA presented a more lucrative market for criminals.
"In South Africa, there is more to monetise," he said. "Cyber criminals see either a better rate of campaign success – people clicking things – or a better success rate once they do click. I think it's a bit of both… this is truly a business."
'EDR killers' weaken defences
The report highlights the growing use of "EDR killers" – tools designed to freeze, blind and disable security solutions on targeted systems.
Allan Juma, lead cyber security engineer at ESET, said the "bring your own vulnerable driver" method was the most common. Attackers introduce a vulnerable version of a legitimate driver, then exploit it to eliminate security processes.
"Malicious actors want to weaken defences so they can wreak havoc," he said.
A generic screen-lock tool, described as an opportunistic attack using script keys, topped the threat list in Africa at 44.7%. Anscombe and Juma said this was scareware aimed at users and businesses lacking the skills or resources to recover compromised systems.
"But the real organised threat actors or ransomware groups are actually sitting underneath all this noise," said Juma. "They target specific individuals or organisations that have a higher impact and higher chance of payout."
Third-party AI skills a growing risk
ESET also warned about AI skills – small pieces of third-party code designed to plug into AI systems and extend their capabilities. These are downloaded from public repositories with no verification or governance.
Analysing about 900 000 skills from popular repositories, ESET found 25 000 suspicious and more than 3 000 outright malicious.
"The most common purpose behind malicious AI skills is credential theft, the same objective that underpins most network intrusions," said Anscombe.
He said 84% of the analysed skills execute commands without user initiation and 31% download third-party tools into environments. Some can also map networks and establish persistence, remaining active even after the skill is removed.
Worryingly, some skills can rewrite themselves once installed, modifying their behaviour beyond their intended boundaries.
Phishing and manipulation on the rise
Despite AI's rise, traditional phishing and threat manipulation remain high-risk.
ESET’s detection of ClickFix – a technique that presents a fake problem and offers a quick fix – increased by 108% between the second half of 2025 and the first half of 2026.
Newer variants include CrashFix, which uses fake security warnings to pressure victims into running harmful commands, and ConsentFix, which targets sign-in workflows to steal authorisation tokens and bypass multi-factor authentication.
Anscombe said SA’s profile as a comparatively wealthy, predominantly English-speaking market made it an efficient target. Cyber criminals will always go after the market where they have the most to gain, he added.
Quishing enters top 10
QR code phishing – or quishing – has reached record levels and entered the top 10 threats for SA and Africa. During the reporting period, 11% of all detected phishing e-mails carried a QR code, often directing victims to personal mobile devices outside corporate defences.
Quishing works because people rarely scrutinise a QR code before scanning it. Detection in SA (2.1%) sits below larger markets such as North America (12.4%), suggesting room for further growth locally.
Once a phishing message succeeds, an information stealer typically harvests credentials. SnakeStealer, one of the most prominent examples, accounted for 10.7% of infostealer detections in SA, against 5.4% across Africa.
It collects saved passwords, browser and e-mail credentials, and session cookies. Offered as malware as a service, complete with dashboards and data storage, it allows low-skilled operators to run credential theft they could never build themselves.
Whether through unvetted AI skills, rented infostealers or AI-themed lures, every attack relies on misplaced trust, the report concludes.
Share
