HP has published its latest Threat Insights Report, which analyses real-world cyberattacks to help organisations track the latest techniques cybercriminals use to evade detection and compromise computers in the constantly changing cybercrime landscape.
Based on data from millions of endpoints using HP Wolf Security, the most significant campaigns identified by HP Wolf Security threat researchers include:
- Fake AI trading agents target cryptocurrency users with malware: Cybercriminals are exploiting growing interest in Agentic AI by promoting fake AI trading agents, aiming to trick users into installing malware themselves. Once installed, the malware checks victims’ browsers for cryptocurrency wallet extensions, such as Coinbase and MetaMask, and replaces them with malicious imitations that steal any credentials users enter. Once the credentials have been stolen, attackers can easily access and steal the victims’ cryptocurrency holdings.
- QR phishing remains a common way to steal credentials: Attackers use QR codes to move victims from computers to mobile devices with fewer layers of protection. Victims receive PDF files containing content supposedly “blurred for security reasons”. They are then asked to scan a QR code with their mobile phone, which redirects them to phishing websites that may have been blocked on their computer, putting their login details at risk.
- The Phantom Stealer ecosystem is expanding: Researchers identified Phantom Gate, a new malware loader that appears to extend the Phantom Stealer campaign. Combining the Phantom Stealer malware, openly marketed as legitimate penetration-testing software, with the Phantom Gate loader makes it easier for threat actors to create and scale attack campaigns.
Patrick Schläpfer, Principal Threat Researcher at the HP Security Lab, said: “Attackers are capitalising on the adoption of Agentic AI tools to invest in new ways of tricking users into downloading malware that looks legitimate.
This tactic makes malware distribution more sophisticated and harder to detect. New attack tools such as Phantom Gate reflect the expanding threat landscape. They allow threat actors to easily assemble dangerous infection chains, significantly increasing the risk of compromise for organisations.”
By isolating threats that have evaded endpoint detection tools while allowing malware to run safely in protected containers, HP Wolf Security gains insight into the latest techniques used by cybercriminals.
To date, HP Wolf Security customers have clicked on 60 billion email attachments, websites and downloaded files, with no breaches reported.
The report, which examines data from April to June 2026, analyses how cybercriminals continue to diversify their attack methods to bypass security tools, finding that:
- At least 10% of email threats detected by HP Sure Click managed to bypass one or more email gateway scanners.
- Executable files were the most common type used to deliver malware (40%), followed by archive files (38%) and PDF documents (7.5%).
James Wright, HP’s Global Head of Security for Personal Systems, said: “Users are constantly moving between devices and applications, such as browsers or new AI tools, and attackers are quick to follow.
Security must work across all these interactions without getting in users’ way. That means organisations need a zero-trust approach based on isolating and containing threats, so that untrusted clicks and file downloads do not become a risk.”
To read the report, visit the HP Threat Research Blog.