Kaspersky Flags AI And Password Risks For Malaysian Firms

Malaysian businesses are facing a broader workplace cybersecurity exposure as employees use AI tools, personal devices and shared online services across office and home settings.

Kaspersky linked those habits to weak passwords, compromised accounts, unsecured services and rising detections of spyware, backdoors and software disguised as AI products.

Everyday tools widen workplace exposure

Kaspersky’s findings show how deeply AI has entered daily workflows in Malaysia.

Among Malaysian respondents who had used AI tools, 87% said they used them to search for information.

Another 63% used AI for work-related tasks, including preparing reports, presentations, data analysis and generating ideas.

More than one-third also used AI for personal activities such as studying, entertainment, travel planning and other daily tasks.

The overlap matters because employees increasingly use the same devices, accounts, applications and online services for personal and professional purposes.

Only 57% of Malaysian respondents said they had enabled two-factor authentication, while 44% continued to use easy-to-remember passwords.

Another 40% said they used password generators.

A study cited by Kaspersky from the Malaysian Employers Federation found that more than 70% of companies in Malaysia had adopted hybrid working models, leaving employees to access company systems from offices, homes and other locations.

Malaysia detections rose in 2025

Kaspersky’s threat intelligence data recorded 194,692 spyware attacks targeting organisations in Malaysia in 2025, a 75% increase from the previous year.

Spyware can collect sensitive information.

The company also detected and blocked 212,239 backdoor attacks against Malaysian businesses during the same period, up 86% year on year.

Backdoors allow attackers to maintain unauthorised access to compromised systems.

These figures are vendor detections, rather than a count of named companies or confirmed national breaches.

Fake AI services target SMBs

Kaspersky detected more than 92,000 malware and potentially unwanted application attacks worldwide between January and early May 2026 that were disguised as AI services.

Fake ChatGPT accounted for nearly half of those detections.

Malwarebytes reported in May 2026 that a fake ChatGPT download site imitated OpenAI’s desktop app page and delivered malware to Windows and macOS users.

The reported payloads included credential-stealing malware and a macOS stealer.

The FBI has also warned that cybercriminals use redirection systems to send users to fake login pages, phishing sites and malware-laced software updates.

The US Federal Trade Commission advises users to avoid unfamiliar websites when downloading free content because of malware exposure risks.

The threat was especially visible in small and medium-sized businesses.

From January to April 2026, Kaspersky’s security solutions detected more than 33,300 global SMB attacks in which malicious or unwanted PC software was disguised as popular AI services—almost five times the figure from the same period in 2025.

ChatGPT, Claude and DeepSeek were the most common AI-themed lures, accounting for 42%, 24% and 20% of detections, respectively.

In Southeast Asia, Kaspersky recorded more than 1,800 SMB attacks involving software disguised as AI services during the same period, nearly seven times higher year on year.

Micro, small and medium-sized enterprises account for 97.2% to 99.9% of establishments across ASEAN member states.

Many of the malicious files targeting SMBs were Trojware, which is designed to appear harmless but can download additional malware or steal, delete, block, modify or copy data from compromised devices.

Kaspersky also blocked almost 415,000 attacks involving software disguised as Telegram, WhatsApp, Zoom and Microsoft Teams from January to April 2026.

That figure changed only marginally from the previous year.

Adrian Hia, Managing Director for Asia Pacific at Kaspersky, said employee behaviour remains part of organisational cybersecurity risk.

“Businesses can deploy sophisticated security strategies and solutions, but the reality is that employees do not leave their digital habits at the office door,” Hia said.

“The same behaviours that guide how people interact with technology in their personal lives can also carry over into the workplace.”