Kaspersky reports SME cyber attack increase by 115% in Q1 2025, driven by malware disguised as fake productivity and AI tools
Small and Medium-scale Enterprises (SMEs) have recorded a 115 percent SME cyber attack increase from fake productivity tools and artificial intelligence platforms.
This concerning trend was disclosed by global cybersecurity and antivirus company, Kaspersky, on Thursday, indicating that these attacks took place within the first four months of 2025.
The new report revealed that in 2025, nearly 8,500 users from small and medium sized businesses globally faced cyberattacks where malicious or unwanted software was disguised as popular online productivity tools, according to Kaspersky.
Based on the unique malicious and unwanted files observed, the most common lures included widely used applications such as Zoom and Microsoft Office.
More recently, newer AI based services like ChatGPT and DeepSeek are being increasingly exploited by attackers.
Kaspersky analysts, in exploring how frequently malicious and unwanted software are disguised as legitimate applications commonly used by SMBs, sampled 12 online productivity apps.
They observed more than 4,000 unique malicious and unwanted files disguised as these popular applications in 2025 alone.
Cybersecurity experts noted that with the burgeoning popularity of AI services, cybercriminals are increasingly disguising malware as AI tools to trick unsuspecting users.
The report specifically indicated that the number of cyber threats mimicking ChatGPT increased by a staggering 115 percent in the first four months of 2025 compared to the same period last year, reaching 177 unique malicious and unwanted files.
Another popular AI tool, DeepSeek, which launched in 2025, immediately appeared on the list of impersonated tools, accounting for 83 malicious files.
Commenting on the report, Vasily Kolesnikov, a security expert at Kaspersky, offered insights into the attackers’ methods.
The likelihood that an attacker will use a tool as a disguise for malware or other types of unwanted software directly depends on the service’s popularity and hype around it.
“Interestingly, threat actors are rather picky in choosing an AI tool as bait. For example, no malicious files mimicking Perplexity were observed. The likelihood that an attacker will use a tool as a disguise for malware or other types of unwanted software directly depends on the service’s popularity and hype around it.”
He added, “The more publicity and conversation there is around a tool, the more likely a user will come across a fake package on the internet.”
He advised that to be on the safe side, SMB employees, as well as regular users, should exercise caution when looking for software online or coming across too good to be true subscription deals.
He stressed the importance of always checking the correct spelling of the website and links in suspicious emails, as these may lead to phishing sites or download malicious software.
A breakdown of the report’s findings showed that the number of malicious and unwanted software files disguised as Zoom increased by nearly 13 percent in 2025, reaching 1,652 incidents.
Similarly, names such as Microsoft Teams and Google Drive saw increases of 100 percent and 12 percent, respectively, with 206 and 132 reported cases.
Among the analysed samples, the highest number of files mimicked Zoom, accounting for nearly 41 percent of all unique files detected.
Microsoft Office applications remained frequent targets for impersonation, with Outlook and PowerPoint each accounting for 16 percent, Excel for nearly 12 percent, while Word and Teams made up nine percent and five percent, respectively.