PromptLock ransomware and AI-driven cyberattacks surge in H2 2025
ESET Research reported that AI-powered cyberattacks surged in the second half of 2025, with PromptLock emerging as the first AI-based ransomware capable of automatically generating malicious scripts. Investment scams and ransomware attacks increased significantly, with ransomware victim counts exceeding 2024 levels and predicted to rise 40% for the year, while AI-generated deepfakes and phishing improved attack sophistication.
What happened
In the second half of 2025, ESET detected PromptLock, the first AI-powered ransomware capable of automatically generating malicious scripts, marking the transition of AI-driven malware from experimental stage to practical deployment.
ESET observed Nomani investment scams using improved deepfakes, AI-generated phishing sites, and brief advertising campaigns to evade detection, with reports increasing 62% year-over-year despite a slight slowdown in H2 2025. These fraudulent operations, initially spread on Meta, expanded to other platforms including YouTube.
Ransomware victim counts exceeded 2024 levels early in 2025, with ESET predicting a 40% annual increase. The Akira and Qilin groups dominated ransomware-as-a-service operations, while a new actor called Warlock introduced novel evasion techniques.
Reported impact
Cyberattacks leveraging AI have increased significantly, with ransomware and financial fraud reaching unprecedented levels in 2025.
Poland was identified as the most heavily impacted country, accounting for 32% of detected attacks involving CloudEyE.
Index analysis
Lumma Stealer, neutralized globally in May 2025, attempted two brief returns before declining, with detections falling 86% between H1 and H2 2025. Its primary distribution method, the HTML/FakeCaptcha Trojan used in ClickFix attacks, nearly disappeared.
CloudEyE (GuLoader) experienced a 30-fold increase in activity during H2 2025, distributed through malicious email campaigns to install ransomware and information-stealing tools including Rescoms, Formbook, and Agent Tesla.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.