Beware of 2026 Cyber Attacks on MSMEs: AI-Disguised Malware Soars
The cyber threat landscape for the Micro, Small, and Medium Enterprises (MSME) sector has undergone a significant shift in early 2026. The latest report from Kaspersky reveals a worrying trend where cybercriminals are increasingly exploiting the popularity of Artificial Intelligence (AI) as bait to distribute malware.
Between January and April 2026, Kaspersky’s security solutions detected over 33,300 attacks against MSMEs worldwide using the guise of popular AI services. This figure represents an almost fivefold increase compared to the same period in 2025. Southeast Asia has become one of the most affected regions, with over 1,800 attacks, representing a year-on-year increase of nearly seven times.
Attackers are targeting business owners by disguising malware as legitimate productivity tools. In Southeast Asia, ChatGPT remains the most dominant bait, followed by other rising AI services such as DeepSeek and Claude.
In addition to AI, communication and video conferencing applications remain persistent classic threats. Kaspersky blocked nearly 415,000 attacks masquerading as Telegram, WhatsApp, Zoom, and Microsoft Teams in the first four months of 2026.
The most frequently encountered type of threat is Trojware. This malware works by disguising itself as a harmless file to trick employees into installing it. Once it successfully enters the system, Trojware can steal, delete, block, or copy sensitive company data.
Vasily Kolesnikov, a security expert at Kaspersky, emphasised that the emergence of new tools, such as OpenClaw which became popular in 2026, is quickly being adopted by cybercriminals as new traps.
“Employees must be extremely careful when searching for software on the internet. Always check the spelling of websites and do not arbitrarily click on links in suspicious emails,” he stated.
Adrian Hia, Managing Director for Asia Pacific at Kaspersky, highlighted that MSMEs are the backbone of the Southeast Asian economy, accounting for over 90% of businesses in the region. Limited resources often make them considered “soft targets” by hackers.