Attacks on SMEs: Fake ChatGPT delivers malware instead of help

A recent Kaspersky study indicates a significant escalation in cyberattacks targeting Small and Medium-sized Enterprises (SMEs), with approximately 8,500 employees deceived by malware disguised as popular productivity tools between January and April 2025. The report highlights a substantial increase in malicious files mimicking ChatGPT (up 115%) and Microsoft Teams (up 100%), alongside other widely used applications like Zoom and Google Drive, with over 4,000 such files identified. This trend underscores a growing operational and financial risk for SMEs, as threat actors increasingly leverage the popularity of software for sophisticated phishing and malware distribution, posing broader implications for supply chain integrity and digital security across the economy.

Analysis

A recent Kaspersky study highlights a significant escalation in cyberattacks targeting Small and Medium-sized Enterprises (SMEs), creating a heightened operational risk environment for this business segment. Between January and April 2025, approximately 8,500 SME employees were targeted with malware disguised as popular productivity and AI applications. The report quantifies a substantial year-over-year increase in malicious files mimicking specific high-trust brands, with those imitating ChatGPT rising by 115% and Microsoft Teams doubling with a 100% increase. Similar, albeit smaller, increases were noted for Zoom (+13%) and Google Drive (+12%). Zoom was the most frequently impersonated application, accounting for 41% of all detected malicious files. This trend indicates that cybercriminals are strategically leveraging the brand recognition and popularity of dominant software platforms, including Microsoft's broader Office suite, to distribute malware such as Trojans and adware. While the direct financial and operational impact falls on the SMEs, this poses an indirect reputational risk to the technology companies whose products are being exploited as bait, including Microsoft (MSFT), Zoom (ZM), and Alphabet (GOOGL). The selective targeting of hyped services like ChatGPT, while less popular AI tools are ignored, demonstrates a clear correlation between market attention and threat actor activity.

Key Decisions for Investors

• The escalating threat landscape for SMEs serves as a strong tailwind for the cybersecurity sector; investors should assess opportunities in firms providing endpoint protection and threat intelligence, as demand from this underserved market is likely to increase.
• For holders of Microsoft (MSFT), Zoom (ZM), and Alphabet (GOOGL), this news represents a minor reputational risk rather than a direct threat to core financials, though it is prudent to monitor whether brand impersonation trends lead to increased security-related operating costs or measurable erosion of user trust.
• The 115% surge in attacks using ChatGPT's brand as a lure underscores how rapidly threat actors can weaponize popular new technologies, suggesting that investors in the AI space should consider the 'threat surface' of a service as part of their risk assessment.