10 minhigh
Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools
Kaspersky's 2026 SMB threat report identifies a surge in attacks weaponizing trust in AI tools, with malware disguised as popular AI services increasing nearly fivefold year-over-year. Phishing campaigns abuse legitimate third-party platforms (Zoom Docs, OneDrive notifications, Google APIs) to bypass email security and harvest corporate credentials. Dark web initial access brokers disproportionately target SMBs, accounting for over half of all access offers analyzed, as SMBs serve as both direct victims and stepping stones to larger enterprises via trusted relationship attacks.
Sens:7d
Detection / Hunteropenrouter
What Happened
Cybercriminals are increasingly targeting small and medium-sized businesses by disguising malware as popular artificial intelligence tools. Attacks using fake AI tool downloads grew almost five times in early 2026 compared to the previous year. Attackers also send phishing emails that impersonate trusted services like OneDrive, Zoom, and Apple to trick employees into giving up passwords and other sensitive information. Separately, criminals are selling unauthorized access to small business computer systems on dark web forums, with more than half of these sales targeting small and medium-sized companies. Small businesses are attractive targets because they often have weaker security than large corporations but may be trusted partners of those larger companies. Businesses should train employees to recognize phishing, restrict access to sensitive systems, keep software updated, and use security tools designed for their size and budget.
Key Takeaways
- Attacks on SMBs using malware disguised as popular AI tools increased nearly fivefold in the first four months of 2026 compared to 2025, with 33,352 detected attacks and over 1,100 unique malware samples.
- Fake communication apps and video conferencing software remained the most widespread lure, with 414,736 attacks detected from January to April 2026.
- Phishing campaigns abuse legitimate platforms (OneDrive, Zoom Docs, Google APIs) to bypass email filters and harvest corporate credentials, using personalized email parsing to appear authentic.
- Over half of dark web initial access offers targeted small and medium-sized businesses, with posts related to Middle East, Africa, and Latin America increasing significantly.
- A two-stage phishing scheme uses legitimate Zoom Docs pages to host hidden phishing links, exploiting trust in a reputable collaboration platform.
Affected Systems
- Windows endpoints in SMB environments
- Corporate email systems
- Social media business accounts (Facebook)
- Cloud collaboration platforms (OneDrive, Zoom Docs)
- Corporate infrastructure accessible via RDP or web shells
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Attackers distribute phishing emails impersonating OneDrive, Apple, Facebook, or financial institutions, or distribute malware disguised as popular AI tools and communication apps to SMB employees.
- Execution: Victims click malicious links or open Trojan-laden attachments (e.g., fake RFQ document attachments), executing Trojware capable of downloading additional malware.
- Credential Theft: Phishing pages hosted on or behind legitimate platforms (Zoom Docs, Google APIs open redirects) harvest corporate email, social media, and financial service credentials.
- Monetization: Stolen credentials and initial access to SMB infrastructure are sold on dark web forums by initial access brokers, with access priced based on company revenue and privilege level.
- Follow-on Exploitation: Buyers of initial access use compromised SMB infrastructure for ransomware deployment, data theft, or trusted relationship attacks against larger enterprise partners.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules, queries, or signatures are provided in the article. The report is based on Kaspersky Security Network telemetry and describes threat trends and examples without publishing actionable detection logic.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | The article describes Trojware delivered via fake AI tool installers and malicious email attachments, but no specific file names, hashes, or behavioral indicators are provided. EDR detection would rely on generic behavioral analysis of trojan download activity. |
| Network Visibility | Medium | Phishing campaigns abuse legitimate platforms (Zoom Docs, Google APIs, OneDrive notification lures) making network-level detection difficult. The two-stage Zoom Docs phishing scheme and open redirect via apis.google.com would appear as legitimate traffic to most network monitoring tools. |
| Detection Difficulty | Hard | Attackers leverage legitimate platforms and open redirects to bypass traditional email filters. Phishing emails are personalized using parsed recipient email address data. No concrete IOCs such as IPs, domains, or file hashes are provided, requiring behavioral and content-based detection approaches. |
Required Log Sources
- Email gateway logs and URL rewriting logs
- Web proxy logs for destination URL analysis
- EDR process execution and file write telemetry
- DNS resolution logs for newly registered domains
- Authentication logs for anomalous login locations
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for inbound emails containing links to docs.zoom.us that also contain phrases about meeting invitations or acceptance buttons, as this legitimate platform is abused to host hidden phishing links in a two-stage scheme. | Email gateway logs, web proxy logs, URL sandbox detonation results | Initial Access | High — Zoom Docs is a legitimate collaboration platform used for real meetings; correlation with additional indicators such as suspicious sender domains or mismatched reply-to addresses is needed. |
| Consider hunting for emails that parse the recipient's email address and inject the extracted company name or username into the notification body, as attackers use this technique to make phishing emails appear as standard service notifications. | Email gateway logs with full body content, DLP content inspection | Initial Access | Medium — legitimate notification services also personalize emails using recipient data; focus on emails from unverified or spoofed sender addresses. |
| Consider hunting for executable files or installers distributed outside official app stores that claim to be AI tools such as Claude or OpenClaw, as attackers distribute Trojware disguised as these popular applications. | EDR file creation events, application installation logs, web proxy download logs | Execution | Low to Medium — legitimate AI tools may be distributed via direct download; verify publisher signatures and download source domains. |
| Consider hunting for emails containing open redirect URLs structured with apis.google.com followed by a redirect parameter pointing to an external domain, as this pattern is used to bypass URL reputation checks. | Email gateway URL extraction logs, web proxy logs | Initial Access | Medium — Google APIs open redirects are used legitimately in some application flows; focus on redirect destinations that are newly registered or categorized as suspicious. |
Control Gaps
- Traditional email filters that rely on sender reputation or URL blocklists may not catch phishing emails that abuse legitimate platforms like Zoom Docs and Google APIs open redirects.
- Endpoint protection that relies on signature-based detection may miss novel Trojware samples disguised as AI tool installers, as over 1,100 unique samples were identified in four months.
- Network security tools may not distinguish between legitimate access to collaboration platforms and phishing pages hosted on those same platforms.
- Organizations without dark web monitoring may be unaware that their compromised infrastructure access is being sold by initial access brokers until a follow-on attack occurs.
Key Behavioral Indicators
- Email notifications claiming to be from OneDrive that include phrases like 'encrypted and hosted within your secure cloud perimeter' combined with non-Microsoft sender domains
- Emails impersonating Apple compliance notifications referencing Google Ads campaigns and Apple seller accounts, with buttons linking to phishing sites via apis.google.com open redirects
- Inbound emails with subject lines containing 'quote' or 'RFQ' language with document attachments from unknown senders, potentially carrying Trojan payloads
- Facebook phishing notifications containing appeal codes and claiming Community Standards violations, directing users to credential harvest pages
- Executable files or installers downloaded from non-official sources claiming to be AI tools such as Claude or OpenClaw
False Positive Assessment
High — The attack techniques described heavily abuse legitimate platforms (Zoom Docs, Google APIs, OneDrive branding) and popular software categories (AI tools, communication apps). Distinguishing malicious from legitimate use of these platforms requires contextual analysis of sender reputation, URL destination, and user behavior patterns.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing recent email gateway logs for messages containing links to docs.zoom.us, apis.google.com redirects, or OneDrive-themed notifications from non-Microsoft senders.
- If your email security platform supports URL rewriting and time-of-click analysis, consider enabling it to intercept phishing links hidden behind legitimate platform URLs.
- Consider alerting finance and HR teams about phishing campaigns impersonating banks, Apple compliance, and Facebook business page notifications, as these are active lures targeting SMB employees.
Infrastructure Hardening
- Consider implementing conditional access policies that restrict authentication to corporate services based on device compliance, location, and risk score, reducing the impact of stolen credentials.
- Evaluate whether your organization monitors dark web forums for leaked credentials or initial access offers related to your company, as IABs disproportionately target SMBs.
- If applicable, consider deploying email security solutions that perform content analysis and sandboxing of attachments, as malicious email attachments increased 15% year-over-year.
- Consider reviewing and restricting RDP exposure and web shell accessibility on internet-facing systems, as these are common access types sold by initial access brokers.
User Protection
- Consider deploying endpoint protection with behavioral detection capabilities that can identify Trojware downloaders disguised as legitimate AI tool installers.
- If your organization permits employees to install software, consider implementing application allowlisting or requiring IT department approval for new software installations.
- Consider providing employees with a verified list of official download sources for AI tools and communication applications they are authorized to use.
Security Awareness
- Consider incorporating phishing simulation exercises that replicate the OneDrive notification, Facebook appeal, and fake meeting invitation scenarios described in the report.
- Consider training employees to verify the legitimacy of AI tool offerings by checking official vendor websites before downloading, as attackers exploit AI hype with fake tools.
- Consider educating employees on the tactic of email personalization, where attackers parse recipient email addresses to inject company names into fake notifications to increase perceived legitimacy.
- If applicable, consider adding guidance to existing awareness programs on verifying financial service websites by checking WHOIS records, website age, and user reviews before entering business or personal data.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping7 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Collection
Additional IOCs
- Other:
FQI-1419000895023180- Fake Facebook appeal code sent in phishing notifications claiming business page policy violations to trick owners into submitting credentials.