Hackers are disguising malware as ChatGPT, Microsoft Office, and Google Drive to dupe workers
Beware of downloading applications like ChatGPT, Microsoft Office applications, and Google Drive through search engines
Small and medium-sized businesses (SMBs) across Europe and North, West, and Central Africa are being targeted by malware masquerading as legitimate tools.
According to Kaspersky, cyber criminals are disguising malware and potentially unwanted applications (PUAs) as trusted tools such as ChatGPT, Microsoft Office applications ,and Google Drive.
Between January and April this year, Austria, Italy, and Germany were among the hardest hit countries in Europe, with the campaign accelerating at pace.
Austria accounted for 40% of all detected cases in which PUAs and malware mimicked legitimate brands, followed by Italy at 25%, Germany at 11%, and Spain (10%). Meanwhile, in Africa, Morocco topped the list, with 41% of all detected PUAs.
The most common threats affecting SMBs in Europe included backdoors (24%), Trojans (17%), and not-a-virus:Downloaders (16%). All of these are designed to infiltrate networks without raising suspicion, Kaspersky noted.
In Africa, not-a-virus: Downloaders dominated (55%), followed by DangerousObjects (14%) and Trojans (13%).
“Small businesses face enterprise-level threats, often with startup-level budgets," said Marc Rivero, lead security researcher at the Global Research and Analysis Team (GreAT) at Kaspersky. “The key is knowing where to focus their limited resources for maximum protection."
Kaspersky said these growing threats highlight the need for more robust employee awareness training. Enabling staff to spot the telltale signs of cyber criminal activity is crucial to preventing disaster.
The company also advised enforcing strong authentication and authorization with strict password policies and multi-factor authentication (MFA), regularly updating software and patching vulnerabilities.
Meanwhile, organizations should carry out regular training sessions, focusing on safe email practices, secure password management, recognizing phishing attempts, and the proper handling of sensitive data.
All software should come from official sources – not via search engines – and be installed centrally by the IT team to prevent hidden threats. Similarly, clear access rules should be set for emails, shared folders, and online services, with user activity monitored and access revoked promptly when employees leave the company.
"The best defense against sophisticated malware isn't the most expensive tool - it's understanding how attackers think and closing the doors they're looking for,” said Rivero.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Warning issued as Pakistan-based malware group hits millions globally
- The best malware removal tools 2025
- What is Malware as a Service and why should businesses take note?
-
Cisco sounds alarm over new Russian malware campaign hitting firms in US and EuropeNews UAT-11795 is weaponizing legitimate software such as WebEx and Zoom to dupe victims
-
Why doesn't more data produce better results?ITPro Podcast Riverbed CIO Fernando Castanheira talks about data and how businesses can use it better
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
Opera browser thinks it has the solution to stopping ClickFix malware attacksNews The browser company is targeting a growing source of malicious links with its new Paste Protect feature
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
‘Hacking groups have the transport network firmly in their sights’: Network Rail is battling a torrent of cyber threatsNews FoI requests have revealed that the rail operator is under increasing attack, as cyber criminals set their sights on the transport sector
-
‘This operation marked a shift in strategy’: Three notorious malware networks have been taken down using RICO legislationNews The action involved the use of US racketeering laws to treat two malware families as part of a single conspiracy
-
Developers urged to remain vigilant amid continued Miasma malware risksNews The Miasma malware package uses legitimate OIDC tokens, making it indistinguishable from routine code updates
-
Claude users beware, hackers are using a fake website to dupe developers and deliver malwareNews 'Beagle' is deployed through a Dynamic Link Library (DLL) sideloading chain, and gives attackers remote access to the system
-
North Korean hackers are duping freelance developers with fake interviews to steal cryptocurrency and deliver malware — Sophos warns the 'Nickel Alley' group is using LinkedIn, Upwork, and Fiverr to target victimsNews A fake interview process uses coding tests and repo downloads to deliver malware
