Surge in AI-Driven Ransomware and NFC Fraud Threatens Security

The ESET Threat Report H2 2025 indicates that AI-powered malware has transitioned from theoretical concepts to real-world threats. PromptLock is identified as the first AI-driven ransomware, capable of generating malicious scripts dynamically. This marks a significant shift in how cybercriminals are utilizing AI across the attack lifecycle.

In addition to ransomware, mobile and NFC fraud has surged, with an 87% increase in NFC threats reported. New malware families such as RatOn, which combines remote access trojan capabilities with NFC relay attacks, and PhantomCard, targeting the Brazilian market, exemplify the evolving tactics of fraudsters. These developments underscore the need for organizations to recognize mobile payment systems as critical attack surfaces.

The ransomware landscape remains robust, with projections indicating a 40% increase in victims for 2025. Akira and Qilin are currently leading the ransomware-as-a-service market, while Warlock has introduced new evasion techniques, further complicating the security landscape.

As organizations face these threats, CISOs must adopt a comprehensive approach to security. This includes hardening endpoint detection and response (EDR) systems against sophisticated attacks and implementing zero trust principles for mobile and NFC transactions. The rapid evolution of malware and fraud tactics necessitates a proactive stance in threat modeling and incident response.

With the decline of Lumma Stealer, CloudEyE (GuLoader) has surged, highlighting the adaptability of cybercriminals. Poland experienced 32% of CloudEyE attack attempts, illustrating the regional targeting of threats. This shift emphasizes the importance of localized defenses and the need for organizations to stay vigilant against emerging malware trends.

Understanding the Implications of AI and NFC Threats

The integration of AI in cybercrime signifies a fundamental change in the threat landscape. Organizations must not only defend against traditional attacks but also prepare for AI-enhanced tactics that can adapt in real-time. This includes recognizing the potential for AI to be used in social engineering and phishing attacks.

As mobile and NFC systems become mainstream targets, enterprises must treat these platforms with the same level of scrutiny as other critical infrastructure. Implementing robust security measures, including monitoring for suspicious activity and educating users about potential scams, is essential to mitigate risks.

• PromptLock: The first known AI-driven ransomware that generates malicious scripts dynamically.
• RatOn: A new malware that combines remote access trojan capabilities with NFC relay attacks.
• PhantomCard: Malware adapted to the Brazilian market, demonstrating rapid localization by threat actors.
• CloudEyE (GuLoader): A malware-as-a-service downloader that surged in detection rates, particularly in Poland.
• Lumma Stealer: An infostealer that has seen a significant decline in detections, indicating shifts in the malware landscape.