ESET Threat Report H1 2025

ClickFix became the second most common attack method after phishing.

ClickFix was responsible for nearly 8% of all blocked attacks in H1 2025.

Before disruption, Lumma Stealer activity in H1 2025 was higher than in H2 2024 (+21%).

NFC-based fraud spiked by more than thirty-five-fold.

Danabot activity was up even more, by +52%.

Yearly data from 2024 shows that while ransomware attacks and the number of active gangs have grown, ransom payments saw a significant drop

Android adware detections jumped 160%.

ClickFix, a new deceptive fake error attack vector, surged by over 500% compared to H2 2024 in ESET telemetry.