These findings are part of the Kaspersky Security Bulletin series where we review the key cybersecurity trends of the past year.

Windows remains the primary target for cyberattacks. 48% of users on Windows were targeted by different types of threats throughout 2025. For Mac users, this figure stands at 29%.

Web threats

Globally, 27% of users were attacked with web threats – these refer to malware that targets users when they are online. Web threats are not limited to online activity, but ultimately involve the Internet at some stage for inflicted harm. In Latin America, 26% of users were attacked by web threats in 2025, while this share reached 25% in Africa, 21% in Europe and 19% in the Middle East.

On-device threats

33% of users were attacked with on-device threats. These include malware that is spread via removable USB drives, CDs and DVDs, or that initially makes its way onto the computer in non-open form (for example, programs in complex installers, encrypted files, etc.). Africa headed the rating with 41% of users attacked with this type of threat; APAC reached 33%, Middle East – 32%, Latin America – 30%, and Europe 20%.

“The current cyberthreat landscape is defined by increasingly sophisticated attacks on organisations and individuals around the world. One of the most significant revelations made by Kaspersky this year was the resurgence of the Hacking Team after its 2019 rebranding, with its commercial spyware Dante used in the ForumTroll APT campaign, incorporating zero-day exploits in Chrome and Firefox browsers. Vulnerabilities remain the most popular way for attackers to get into corporate networks, followed by using stolen credentials – hence the rise in password stealers and spyware we see this year. Supply chain attacks are also common, including attacks on open-source software. This year the number of such attacks increased significantly, and we even saw the first widespread NPM worm Shai-Hulud,” commented Alexander Liskin, Head of Threat Research at Kaspersky.

“This increasingly complex threat landscape makes implementing robust cybersecurity strategies vital for organisations, as failure to do so can lead to months of downtime in the event of attacks. Individual users should also always use reliable security solutions, otherwise they put not only their data and money at risk, but also those of the organisations where they work.”

The post Kaspersky detected half a million malicious files daily in 2025 appeared first on ProtectionWeb.

By exploiting a zero-day vulnerability in a contractor’s publicly accessible application, it was possible to gain control over the vehicle telematics system, compromising the physical safety of drivers and passengers. For instance, attackers could force gear shifts or turn off the engine when the vehicle is driving. The findings highlight potential cybersecurity weaknesses in the automotive industry, prompting calls for enhanced security measures, Kaspersky said.

The security audit was conducted remotely and targeted the manufacturer’s publicly accessible services and the contractor’s infrastructure. Kaspersky identified several exposed web services. First, through a zero-day SQL injection vulnerability in the wiki application (a web-based platform that allows users to collaboratively create, edit, and manage content), the researchers were able to extract a list of users on the contractor’s side with password hashes, some of which were guessed due to a weak password policy. This breach provided access to the contractor’s issue tracking system (a software tool used to manage and track tasks, bugs, or issues within a project), which contained sensitive configuration details about the manufacturer’s telematics infrastructure, including a file with hashed passwords of users of one of the manufacturer’s vehicle telematics servers. In a modern car, telematics enables the collection, transmission, analysis, and utilisation of various data (e.g., speed, geolocation, etc.) from connected vehicles.

On the connected vehicle side, Kaspersky discovered a misconfigured firewall exposing internal servers. Using a previously acquired service account password, the researchers accessed the server’s file system and uncovered credentials for another contractor, granting full control over the telematics infrastructure. Most alarmingly, the researchers discovered a firmware update command that allowed them to upload modified firmware to the Telematics Control Unit (TCU), Kaspersky said. This provided access to the vehicle’s CAN (Controller Area Network) bus – a system that connects different parts of the vehicle, like the engine and sensors. Afterwards, various other systems were accessed, including the engine, transmission, etc. This enabled potential manipulation of a range of critical vehicle functions, which could endanger driver and passenger safety.

“The security flaws stem from issues that are quite common in the automotive industry: publicly accessible web services, weak passwords, lack of two-factor authentication (2FA), and unencrypted sensitive data storage. This breach demonstrates how a single weak link in a contractor’s infrastructure can cascade into a full compromise of all of the connected vehicles. The automotive industry must prioritise robust cybersecurity practices, especially for third-party systems, to protect drivers and maintain trust in connected vehicle technologies,” said Artem Zinenko, Head of Kaspersky ICS CERT Vulnerability Research and Assessment.

Kaspersky recommends that contractors restrict Internet access to web services via VPN, isolate services from corporate networks, enforce strict password policies, implement 2FA, encrypt sensitive data, and integrate logging with a SIEM system for real-time monitoring.

For the automotive manufacturer, Kaspersky advises restricting telematics platform access from the vehicle network segment, using allowlists for network interactions, disabling SSH password authentication, running services with minimal privileges, and ensuring command authenticity in TCUs, alongside SIEM integration.

The post Kaspersky finds security flaws that threaten vehicle safety appeared first on ProtectionWeb.

This is according to cybersecurity and digital privacy company Kaspersky, which said it detected and blocked over 142 million phishing link clicks in Q2 2025, a 3.3% increase globally and a 25.7% increase in Africa from Q1.

AI has elevated phishing into a highly personalised threat, Kaspersky said. Large language models (LLMs) enable attackers to craft convincing emails, messages and websites that mimic legitimate sources, eliminating grammatical errors that once exposed scams. AI-driven bots on social media and messaging apps impersonate real users, engaging victims in prolonged conversations to build trust. These bots often fuel romantic or investment scams, luring victims into fake opportunities with AI-generated audio messages or deepfake videos.

Attackers also create realistic audio and video deepfake impersonations of trusted figures — colleagues, celebrities or even bank officials — to promote fake giveaways or extract sensitive information. For instance, automated calls mimicking bank security teams use AI-generated voices to trick users into sharing two-factor authentication (2FA) codes, enabling account access or fraudulent transactions. Additionally, AI-powered tools analyse public data from social media or corporate websites to launch targeted attacks, such as HR-themed emails or fake calls referencing personal details.

Employing new tactics to bypass detection

Phishers are deploying sophisticated methods to gain trust, exploiting legitimate services to prolong their campaigns. For instance, Telegram’s Telegraph platform, a tool to publish long texts, is used to host phishing content. Google Translate’s page translation feature generates links that look like https://site-to-translate-com.translate.goog/… and are used by attackers to bypass security solutions’ filters.

Attackers now also integrate CAPTCHA, a common anti-bot mechanism, into phishing sites before directing users to the malicious page itself. By using CAPTCHA, these fraudulent pages deflect anti-phishing algorithms, as the presence of CAPTCHA is often associated with trusted platforms, lowering the likelihood of detection.

A switch in hunting: From logins and passwords to biometrics and signatures

The focus has shifted from passwords to immutable data. Attackers target biometric data through fraudulent sites that request smartphone camera access under pretexts like account verification, capturing facial or other biometric identifiers that cannot be changed. These are used for unauthorised access to sensitive accounts or sold on the dark web. Similarly, electronic and handwritten signatures, critical for legal and financial transactions, are stolen via phishing campaigns impersonating platforms like DocuSign or prompting users to upload signatures to fraudulent sites, posing significant reputational and financial risks to businesses.

“The convergence of AI and evasive tactics has turned phishing into a near-native mimic of legitimate communication, challenging even the most vigilant users. Attackers are no longer satisfied with stealing passwords — they’re targeting biometric data, electronic and handwritten signatures, potentially creating devastating, long-term consequences. By exploiting trusted platforms like Telegram and Google Translate, and co-opting tools like CAPTCHA, attackers are outpacing traditional defences. Users must stay increasingly sceptical and proactive to avoid falling victim,” said Olga Altukhova, security expert at Kaspersky.

Earlier in 2025 Kaspersky detected a sophisticated targeted phishing campaign which was dubbed Operation ForumTroll, as attackers sent personalised phishing emails inviting recipients to the “Primakov Readings” forum. These lures targeted media outlets, educational institutions and government organisations in Russia. After clicking on the link in the email, no additional action was needed to compromise their systems: the exploit leveraged a previously unknown vulnerability in the latest version of Google Chrome. The malicious links were extremely short-lived to evade detection and in most cases ultimately redirected to the legitimate website for “Primakov Readings” once the exploit was taken down.

To be protected from phishing, Kaspersky recommends:

Verify unsolicited messages, calls, or links, even if they appear legitimate. Never share 2FA codes.
Scrutinise videos for unnatural movements or overly generous offers, which may indicate deepfakes.
Deny camera access requests from unverified sites and avoid uploading signatures to unknown platforms.
Limit sharing sensitive details online, such as document photos or sensitive work information.

The post Phishing evolves with AI and stealth appeared first on ProtectionWeb.

At a recent media event held in Johannesburg, Maher Yamout, Lead Security Researcher for the Global Research & Analysis Team (GReAT) at Kaspersky, unpacked South Africa’s current cyberthreat landscape, looking at ransomware trends, and the rise of infostealers.

In South Africa in the first half (H1) of 2025, Kaspersky security tools blocked more than 6 million online attack attempts on users. With threats that include phishing scams, exploits, botnets, Remote Desktop Protocol attacks, and network spoofing, such as fake Wi-Fi networks, one in five users in the country (20.9%) were targeted. In the same period, 10.3 million on-device incidents were blocked, where 21.2% of South African users faced malware delivered via infected USB drives, CDs, DVDs, and hidden installers, including ransomware, worms, backdoors, trojans, password stealers, and spyware. Industrial environments also remain a target: attacks on 27.7% of ICS (Industrial Control Systems) computers in South Africa were blocked by Kaspersky solutions in H1 2025.

Kaspersky’s analysis shows that the number of backdoors more than doubled in South Africa in H1 2025, compared to the same period in 2024 (a 123% increase was recorded). Furthermore, banking trojans grew 136%, and password stealers increased 122%. Spyware attacks happened 3.6 times more often, alongside a 14% increase in exploits targeting vulnerabilities in applications like Microsoft Office.

Infostealers remain concerning for both consumers and enterprises. Kaspersky notes that many stealers still reach Windows PCs via phishing and pirated software, reinforcing the need for secure mail gateways, application control, and blocking unapproved software. Moreover, Kaspersky’s research this year exposed SparkCat, the first stealer to infiltrate Apple’s App Store, and also found on Google Play. It scans photo galleries for screenshots containing sensitive data, such as wallet recovery phrases or passwords, demonstrating that storing credentials in images is unsafe. A related family, SparkKitty, was later observed exfiltrating images and device details via apps distributed through official stores and scam sites.

“Knowing the threat landscape becomes an operational concern,” said Yamout. “When you understand which threats are registered in the region, you can tune controls that matter. In our recent work, we have also supported INTERPOL-led efforts to disrupt stealer operations affecting Africa. Meanwhile, cases like SparkCat show why screenshots of passwords or recovery phrases are not safe, even if the app came from an official store.”

Kaspersky solutions registered almost three million phishing attempts in South Africa in the first half of 2025. Although this marks a 29% decrease compared to the same period of 2024, the threat of targeted phishing is still rife in the region. Globally, Kaspersky has tracked phishing campaigns that use AI-generated text, deepfakes, and voice cloning, as well as trusted services such as Telegram pages and Google Translate links, to bypass filters. Some phishing sites also place CAPTCHA screens upfront to reduce machine detection. These realities mirror the lures and infrastructure abuse seen in local incidents.

Furthermore, ransomware remains a leading reason of corporate cyber incidents in South Africa, with targeted groups selecting high-value victims across government and enterprise. Effective defence combines prevention and response. These include adopting rigorous patching, strong authentication, limited remote access, endpoint detection and response (EDR) and extended detection and response (XDR) solutions, regular backups, and user awareness to blunt phishing-led initial access.

“Resilience is built in layers. Map your risks, reduce the attack surface, and plan for containment. If your controls shorten the time from the first suspicious event to isolation and rollback, you change the economics for cyber attackers,” concluded Yamout.

The post Infostealer and ransomware on the rise in South Africa appeared first on ProtectionWeb.

Why do we call it “smart”?

Smart home systems integrate various devices, creating a “living” environment, enabling seamless interaction between gadgets and users. Usually, it has a central hub or controller, which acts as the brain of the smart home. Smart home systems can include a wide variety of devices and appliances such as cameras, sensors, actuators and multiple household gadgets such as fridges, toasters, washing machines and vacuum cleaners. These devices connect with each other and other systems via the Internet.

Users can choose between different options when interacting with their smart home:

• Mobile apps that allow users to control devices, set schedules, and receive notifications even outside the house
• Voice assistants, which enable voice commands to control devices
• Web Portals and online dashboards that provide access to device settings and monitoring after logging in to the user’s account.

Comfort and ease of use are the main advantages of a smart home system. Users can set specific times for devices to perform actions, for example, turning on lights at sunset. Devices can also be programmed to respond to specific events, such as turning on the thermostat when the user arrives home. Even TVs with built-in AI technology, which can help you to discover dishes in shows as they appear on screen, find the recipe, and then compare the products needed for its preparation with those that are in your fridge and make a shopping list doesn’t sound like a fantasy anymore.

Despite the advantages that a smart home system offers, its Achilles’ heel is the Internet connection. Connectivity of all devices to a local Wi-Fi network as well as the need to log into personal accounts makes intelligent gadgets potentially vulnerable to hacking. There are already examples when attackers gained unauthorised access to Ecovacs robot vacuums to spy on their owners and disturb them by making loud noises and uncontrolled moves. Even an Internet-connected mattress system in theory can be hacked, making the gadget potentially unsafe to use.

The vacuum cleaner is watching you

The idea that the regular household items surrounding you every day might be sharing personal data, overhearing, or even watching you, sounds terrifying. However, there is no need to stop using your favourite gadgets. Though examples of smart home device attacks are still rare, basic security rules are essential to safely enjoy the benefits of smart technology, preventing hackers from using them against you.

1. Secure your Wi-Fi network. It’s highly recommended to change the system password that many Wi-Fi routers have by default to a more complex and secure one. Here are some tips on how to create stronger passwords.
2. Monitor your network regularly. Look out for any suspicious activity on your local network or even consider using specific monitoring tools like Kaspersky Wi-Fi Security Check, which alerts you if Wi-Fi security settings are weak or if there are open ports that could allow unauthorised access to your Wi-Fi or smart home devices and Smart Home Monitor, which notifies you when a new device joins your Wi-Fi network so you can disconnect it.
3. Track your device’s activity. Any device’s unusual behaviour might be a signal that somebody has access to it. If you notice suspicious activity it’s recommended to change your account password (if you are logged in on the device) and check your local network traffic.
4. Review the settings regularly. Less is more. Disable any unnecessary features or services on your device that could pose a risk to your privacy or security. For example, you can disable access to a device’s camera and microphone if you are not currently using these functions.
5. Make rational choices. The prospect of using as many smart devices as possible seems very tempting, but remember that every new gadget increases the potential risk to your security, so choose carefully and opt for responsible manufacturers.

The post My house is my castle: Kaspersky explains how to protect smart home devices appeared first on ProtectionWeb.

The findings, drawn from anonymized Kaspersky Security Network (KSN) data, were presented at the GITEX Africa conference in Morocco (14–16 April 2025), highlighting the urgent need for enhanced cybersecurity measures.

Phishing and ransomware continue to be significant threats in the region, with 66 million phishing link clicks seen by Kaspersky in the African region in 2024, including over 14.8 million phishing link clicks by corporate users.

Web-based attacks reached 131.5 million detections in 2024, with Kenya (20 million attempts), South Africa (17 million), and Morocco (12.6 million) most targeted.

Local on-device threats surged by 4%, led by Nigeria (169% increase), Ethiopia (86%), and South Africa (32%). These include malware spread via USB drives, encrypted files, and compromised installers.

Maher Yamout, Lead Cybersecurity Researcher at Kaspersky, attributes the rise to rapid digitisation outpacing security investments and low digital literacy. “Our statistics show an increase in attack detections for several types of cyberthreats, and the factors driving these increases are multifaceted. In the B2B sector, the continuing shift toward hybrid work models and the rush to digitise operations — often outpacing cybersecurity investments — may leave businesses in Africa exposed to advanced persistent threats. In the B2C space, the explosion of digital financial services, coupled with low digital literacy rates, makes individuals prime targets for opportunistic attacks,” Yamout said.

“Organisations in Africa should prioritise a unified approach by enhancing collaboration, investing in specialised cybersecurity training, and promoting digital literacy to effectively combat the rising tide of cybercrime. Initiatives like the African Cyber Surge operation and targeted educational programmes can serve as blueprints for building a resilient digital ecosystem across the continent.”

The post 14% surge in spyware attacks target African businesses appeared first on ProtectionWeb.