AI-powered ransomware surge reported in H2 2025
ESET reported that attackers increasingly used artificial intelligence to power ransomware and mobile malware in the second half of 2025, including PromptLock, the first known AI-powered ransomware. Victim numbers and attack volumes grew significantly across ransomware, NFC-based mobile threats, and data-stealing malware campaigns.
What happened
According to ESET's H2 2025 Threat Report, attackers increasingly applied artificial intelligence to malware campaigns in the second half of 2025. PromptLock, the first known AI-powered ransomware, emerged in practice during H2 2025, automatically generating malicious scripts in real time. NFC-based mobile attacks increased 87% on Android, while ransomware victim numbers exceeded the entire 2024 total before the end of 2025.
PowerShell-based CloudEyE (GuLoader) showed nearly 30-fold growth, distributing ransomware and data-stealing code via email campaigns. New ransomware-as-a-service players including Warlock appeared with advanced evasion techniques, while EDR-killers and the UEFI-based HybridPetya variant targeted endpoint detection systems.
Reported impact
Ransomware victim numbers increased 40% in 2025 and exceeded the full 2024 total before year-end. NFC-based mobile threats on Android jumped 87%, with NGate stealing contact data and RatOn combining remote access with NFC interception attacks.
Index analysis
The attacks became cheaper and more heavily automated through AI application. ESET noted that reactive defense is no longer sufficient as attackers employ automated, AI-supported techniques.
Governance controls
ESET recommended that users and organizations require up-to-date endpoint protection, vulnerability identification, regular updates, and conscious handling of suspicious emails and links in response to automated, AI-supported attacks.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.