Malware attacks on SMBs disguised as AI services surged by five times in 2026, Kaspersky reports

Kaspersky says its security products detected more than 33,300 attacks on SMBs from January to April 2026 in which malicious or unwanted software was disguised as popular AI services. The report says these attacks were five times higher than in the same period of 2025, highlighting social engineering around AI branding as a current SMB threat.

According to Kaspersky, its products detected more than 33,300 cyberattacks on SMBs between January and April 2026 in which malware or potentially unwanted applications were disguised as popular AI services, representing a fivefold increase over the same period in 2025.[1][5] The report notes that lures most often impersonated branded AI tools (e.g., ChatGPT, Claude, DeepSeek), and that over 1,100 unique malicious files were found masquerading as AI platforms.[1][2][5] These are primarily traditional trojans and PUAs using AI branding and fake installers as social-engineering vectors, rather than "AI-powered" malware exploiting the models themselves.[1][3][6] From a RealGround perspective, this trend is best classified as an AI supply chain risk: attackers exploit trust in third‑party AI tools, app stores, and download channels to deliver malware under the guise of legitimate AI services.[1][2][5] Practical implications for SMBs include the need for strict controls on how AI tools are sourced and installed (official channels only), formal vendor and download verification processes, and continuous red teaming of AI-related workflows to test whether staff or systems can be tricke