Cybercriminals are increasingly riding the wave of public excitement around artificial intelligence to trick victims, while quietly shifting phishing attacks from email to QR codes scanned on smartphones, according to HP's September 2026 Threat Insights Report.
The quarterly report, which analyses attack trends observed during the second quarter of 2026, finds that attackers continue to rely on social engineering, legitimate tools and multi-stage infection chains rather than exotic techniques — but are adapting their lures to the technologies people currently trust most.
One of the most notable developments is how criminals are capitalising on enthusiasm for agentic AI. Instead of using sophisticated AI to conduct attacks, many threat actors are simply exploiting users' growing willingness to hand sensitive tasks and information to AI-powered tools.
AI hype as a lure
The report describes campaigns built around fake AI offerings. In one highlighted case, attackers promoted a supposed AI trading agent that, once installed, delivered information-stealing malware to the victim's machine. The promise of AI-powered profits proved to be an effective hook.
The tactic works because it inverts the usual story about AI and security. Much attention has focused on criminals using AI to write better phishing emails — and a parallel industry report from Kaseya found that AI-generated phishing has now become the baseline, with traditional red flags like bad grammar and suspicious domains disappearing. But HP's findings show the simpler play: criminals do not need advanced AI when the hype around AI itself makes victims lower their guard.
Users who would hesitate before opening an unexpected attachment may willingly install an "AI agent" or share sensitive documents with a chatbot, trusting the technology's aura of sophistication. Attackers are building their lures around exactly that trust.
The QR code shift
The report also documents a tactical shift in phishing delivery: attackers are increasingly using QR codes to move attacks from protected PCs onto smartphones. A QR code in an email or message can slip past email security filters, because the malicious destination is encoded in an image rather than written as a suspicious link.
Once the victim scans the code with a phone — typically a less heavily defended device than a corporate laptop — they are taken to a phishing page or prompted to install something malicious. QR codes have become so routine in daily life, from restaurant menus to payments, that many people scan them without a second thought.
The off-the-shelf malware marketplace
HP's researchers also note the continued commercialisation of cybercrime tooling. Off-the-shelf malware kits and phishing platforms are fuelling a growing marketplace that lowers the barrier to entry for less-skilled criminals.
This industrialisation of attack tooling means that effective campaigns no longer require deep technical expertise. A criminal who can buy a convincing phishing kit and rent infrastructure can run operations that, a few years ago, would have demanded a skilled team — multiplying the volume of attacks defenders face.
How to defend against the new lures
Defending against these tactics starts with healthy scepticism. Users should verify QR codes before scanning — checking where they came from and what they claim to do — and be wary of QR codes in unsolicited messages. Organisations can consider disabling automatic QR handling or adding warnings in email clients.
For AI-related lures, the rule is simple: treat any unsolicited AI tool, trading bot or assistant with the same suspicion as any other unexpected download. Do not share sensitive personal or work documents with chatbots and AI tools without understanding how the data will be stored and used. And remember that enthusiasm for a technology is not evidence that an offer involving it is legitimate.
Why it matters for Pakistan
Both trends map directly onto Pakistan's digital landscape. QR codes are now central to everyday payments through Easypaisa, JazzCash and banking apps, and QR-based scams delivered over WhatsApp are already a familiar fraud pattern. Attackers hiding phishing links inside QR images can exploit the same payment habits.
Meanwhile, excitement around AI tools is surging among Pakistani students, freelancers and small businesses — exactly the audience most likely to install a dubious "AI assistant" or share a CV and work documents with a chatbot. HP's report is a reminder that in Pakistan, as everywhere, the most effective security control is still a cautious user.
