More than half (56%) of Internet users faced fraud over the past year, and 45% became victims of attacks on their devices, accounts or data (social media accounts hacking, data leakage, malware infection etc.), according to a new global survey* by Kaspersky.

Scams are now more sophisticated than ever, and Kaspersky’s AI- and ML-powered technologies help users stay protected against fraudulent schemes. For greater confidence and clarity, these capabilities are now grouped into a dedicated block inside Windows and macOS apps.

The scam landscape continues to evolve rapidly, becoming more sophisticated and targeted, and attacks are increasingly powered by AI. Users can face potential threats in almost any type of online interaction: emails, messengers, social media, online shops or apps.

In Q1 2026 only, Kaspersky anti-phishing technologies blocked over 140M phishing and scam attempts, underscoring how pervasive this web threat has become.

Kaspersky experts highlight that scams are becoming more widespread, as almost every emerging trend or global event quickly becomes a foothold for fraudsters.

In March 2026, Kaspersky’s anti-phishing technologies detected rising scam activity around the 2026 World Cup, uncovering fraudulent resources that mimicked official tournament websites or exploited the event to lure users into unsafe interactions.

The same underlying approach, combining machine learning, pattern recognition and real-time threat analysis, also helps Kaspersky technologies detect a broader range of scam scenarios, from classic phishing pages to fake shops, crypto scams and other schemes that may lead to financial loss.

Scam campaigns now may be even fuelled by personal data stolen from breaches, infostealer malware, compromised accounts and other online exposures.

Fraudsters combine this information to craft targeted messages, impersonate trusted contacts or make their scams more convincing. Kaspersky Premium protects customers from various digital threats, reducing these risks across all devices, including smartphones, with protection technologies tailored to each platform and reinforced by AI- and ML-based detection.

These include Data Leak and Identity Theft checkers that warn users about potential exposure of personal information, Kaspersky Password Manager that helps keep credentials secure and unique, and behaviour-based protection technologies such as System Watcher, which uses advanced app behaviour monitoring and pattern recognition to detect signs of misuse or malicious activity in real time.

In Kaspersky apps for Windows and macOS, these capabilities are now brought together in a dedicated AI-powered Scam Protection block, making them easier for users to find and understand, while in mobile apps they continue to work in the background.

“AI-powered scams are a new reality. AI-generated, constantly increasing in volume and lurking everywhere, from fake ticket sites to impersonating friends on messengers, they can trick even the most experienced user. Relying on your own ability to spot a scam is not enough. That’s why we’ve integrated advanced AI detection directly into our products – so our technology can spot what the human eye can’t, and protect users in real time,” comments Marina Titova, Vice President for Consumer Business at Kaspersky.

New AI-labels mark the group of features that provides comprehensive protection from various web threats, allowing Windows and macOS users to find out how the solution secures every aspect of their digital interactions.

New Kaspersky Global Research and Analysis Team (GReAT) research into the rapidly growing ransomware group known as The Gentlemen has showed that the attackers have evolved their tactics through new custom-built tools – a backdoor designed to facilitate information gathering before ransomware deployment and control over compromised systems, and a ransomware executable file.

The group has been active worldwide across industries including manufacturing, IT services, healthcare, financial services, construction, and logistics.

In its recent report Kaspersky shared an overview of ransomware trends: according to Kaspersky Security Network, in 2025 Latin America had the highest share of organisations with ransomware attacks detected (8.13%), followed by the Asia-Pacific region (7.89%), Africa (7.62%), Middle East (7.27%), the Commonwealth of Independent States (CIS, 5.91%) and Europe (3.82%).

The Gentlemen is a rapidly expanding Ransomware-as-a-Service (RaaS) operation believed to have emerged around mid-2025. The Gentlemen and its affiliates primarily gain initial access to victim systems through the exploitation of Internet-facing services and compromised credentials.

The attackers may be seeking collaboration with Initial Access Brokers (IABs) to acquire access to organisations with valuable intellectual property with minimal effort. Kaspersky found that access to some victim systems, using techniques the group does not typically employ, occurred long before the ransomware infection. This may mean that the initial access was not carried out by The Gentlemen, but rather by another threat actor, possibly an IAB.

Unlike many RaaS groups, The Gentlemen demonstrates a high level of sophistication, employing custom tooling and flexible intrusion tactics. Kaspersky researchers identified a previously unknown, custom-developed backdoor written in Go deployed by the attackers one day before ransomware execution.

The implant gathers host and network information and hides its console window to avoid detection. Its capabilities include bidirectional communications with the attackers, server-controlled command execution, and reconnaissance, enabling attackers to extend and adapt their activity within a compromised environment.

Kaspersky also found a new ransomware variant written in C affecting a limited number of corporate victims. While The Gentlemen has primarily used a ransomware implant written in Go that was designed for cross-platform use, the new C-based variant appears to be Windows-focused. The group may be testing the malware in real victim environments as it expands its technical arsenal.

Notably, in their attacks the Gentlemen attempted to remove the Kaspersky security solution by utilising kavrmvr.exe (a tool designed to remove Kaspersky products). However, the Kaspersky solution remained active, and the move by the attackers was blocked and flagged as malicious.

“Despite being a relatively recent entrant to the ransomware threat landscape, The Gentlemen group is rapidly gaining a reputation among threat actors, attracting affiliates and executing high-profile attacks.

“The testing of the new C-based ransomware variants suggests that the group is actively refining its capabilities, which may translate into more stable and scalable attack chains in the near future.

“Organisations should anticipate further malicious ransomware activity and are strongly advised to prioritise vulnerability management and system hardening processes to mitigate the risk of compromise,” said Fatih Sensoy, security expert at Kaspersky GReAT.

From January to April 2026, Kaspersky security solutions detected more than 33,300 attacks on small and medium-sized businesses (SMBs), in which malicious or unwanted software for PCs were disguised as popular artificial intelligence (AI) services. This number has surged by almost five times when compared to the same period in 2025.

A new Kaspersky report reveals threat analysis and mitigation strategies to help SMBs protect themselves against the evolving threat landscape.

Kaspersky experts explored the extent to which threat actors target small and medium-sized businesses with malware disguised as legitimate AI services, considering the growing popularity of such tools for the business workflow. At the beginning of 2026 the most common lures in cyberattacks involved malware posing as ChatGPT (42%), Claude (24%), and DeepSeek (20%).

Among unique malicious files detected in the SMB sector and masqueraded as AI services, Kaspersky experts observed mainly different Trojware (Trojans and Trojan-like malware), including those capable of downloading and running other malware on compromised devices.

Trojware disguises itself as harmless files to trick users into installing them. Their functionality may vary depending on the type of the malware. It may include stealing, deleting, blocking, modifying or copying users’ data, as well as other malicious capabilities. Given this, Trojware represents a highly dangerous cyberthreat to entrepreneurs and businesses.

However, in 2026 Kaspersky telemetry detected even more attacks on SMBs, in which malicious or unwanted software for PCs were disguised as messenger apps and video conferencing software: Telegram, WhatsApp, Zoom and Microsoft Teams. From January to April Kaspersky solutions blocked almost 415,000 such attacks.

The number of attacks changed marginally compared to the previous year’s figures. Thus, Kaspersky experts note that the lure of fake communication apps remains a widespread cyberthreat.

“The threat landscape is evolving with new lures constantly appearing. For example, for the first four months of this year our solutions for small and medium-sized businesses detected hundreds of attacks, in which malicious or unwanted software were disguised as OpenClaw – an AI tool that rapidly gains popularity in 2026.

Corporate employees are increasingly using various AI services and other tools in their workflows, including those that are publicly available. Thus, to be on the safe side, SMB employees – as well as all users – should exercise caution when looking for software on the Internet. Always check the correct spelling of the website and links in suspicious emails, and use robust security solutions,” says Vasily Kolesnikov, security expert at Kaspersky.

“As adversaries constantly refine their methods to exploit human error, the need for up-to-date security awareness training for businesses of all kinds and sizes is undeniable. However, the reality is that micro-organisations often struggle to allocate time and budget to regularly update their staff on the latest threats and malicious trends.

“We believe this issue can be largely addressed through solutions tailored for small businesses which deliver robust core protection while also providing accessible security education,” adds Rodion Pyanov, product manager, Kaspersky Small Office Security.