Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools
Kaspersky reports 33,300 AI-disguised cyberattacks on SMBs in early 2026, up 5x YoY.
Kaspersky's 2026 threat analysis reveals that cyberattacks on SMBs have evolved significantly, with malware and potentially unwanted applications (PUAs) masquerading as legitimate AI tools increasing nearly five-fold compared to 2025. The report documents widespread campaigns using fake versions of popular AI services like Claude and OpenClaw, as well as counterfeit communication apps and office software, to compromise business credentials and infrastructure. Initial access to SMB corporate networks is increasingly commoditized on the dark web, reflecting the perception that smaller enterprises lack the security maturity of larger organizations yet maintain trusted relationships with well-protected enterprises.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Kaspersky?
Get an email when a new story names Kaspersky, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCybercriminals are increasingly exploiting SMBs' limited security maturity by distributing malware disguised as popular AI tools and legitimate software, with such threats growing nearly five-fold year-over-year. Employees downloading unverified AI or productivity tools inadvertently hand attackers credentials and network access, which are then packaged and sold on dark web marketplaces. This matters because SMBs often serve as trusted gateways into larger, better-protected partner organizations, meaning a single compromised small business can cascade into a supply chain breach. The core failure is a lack of employee awareness combined with no enforced controls over which software is permitted on corporate devices.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — OpenClaw
- malware — ClawdBot
- malware — MoltBot