AI-Driven Cyberthreats Escalate for SMBs

Welivesecurity

AI-Driven Cyberthreats Escalate for SMBs

First seen 16 Sep 2026, 11:53 UTC • •51.9

Article Content

1 / 4

Browse articles

ThreatCluster •September 16, 2026 at 12:57 UTC

•73% of SMBs are integrating AI, increasing their attack surface.
•40% of businesses lack a proper AI policy, heightening security risks.
•Over 25,000 suspicious AI skills identified, with 3,000 being malicious.

The cybersecurity landscape is rapidly evolving, driven by AI technology that enhances both the capabilities of threat actors and the attack surfaces of businesses. Small and medium-sized businesses (SMBs) are particularly vulnerable as they adopt AI at an accelerated pace, with 73% integrating it into their operations. However, 40% of these businesses lack a proper AI policy, increasing their risk exposure. Malicious AI skills repositories are emerging, with over 25,000 suspicious skills identified, including 3,000 deemed malicious that can exfiltrate data or execute malware. The complexity of security tools and fragmented policies further complicates defenses, leaving organizations overstretched and unprepared. The urgency for effective cybersecurity measures is emphasized as organizations must balance AI benefits with governance and security needs.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-09-16

AI integration in SMBs reported

73% of SMBs are incorporating AI into their operations, creating new vulnerabilities.

2026-09-16

Malicious AI skills identified

ESET analyzed 900,000 AI skills and found over 25,000 suspicious skills, including 3,000 malicious ones.

2026-09-16

Cybersecurity complexity highlighted

Organizations face challenges due to fragmented tools and overstretched security teams, complicating defenses.

More articles in this cluster (3)

Threat Graph

9 entities, 7 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Data Breach
Malware
Phishing
T1041 - Exfiltration Over C2 Channel
T1566.002 - Spearphishing Link

Weakness (1)

CWE-200 - Exposure of Sensitive Information

Malware (1)

PromptSpy

Affected Platform (1)

Android

Tool (1)

Gemini

Relationships

Data Breach targets Android
Malware targets Android
Phishing targets Android
T1041 - Exfiltration Over C2 Channel targets Android
T1566.002 - Spearphishing Link targets Android
PromptSpy related to CWE-200 - Exposure of Sensitive Information
PromptSpy related to Gemini

Following this threat?

Track PromptSpy in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Surge in Exploited CVEs and Malware Activity in H1 2026 In the first half of 2026, Insikt Group reported 215 actively exploited CVEs, marking a 34% increase from the previous year. Notably, AsyncRAT emerged as the leading malware, with nearly 60,000 unique hashes. The report highlighted a significant rise in NFC-based Android attacks, which surged by 188%. Threat actors…

Critical Cisco FMC Vulnerabilities Under Active Exploitation Cisco's Secure Firewall Management Center (FMC) Software has two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20316, that are currently being exploited by state-sponsored and ransomware actors. CVE-2026-20079, rated 10.0 on the CVSS scale, allows unauthenticated remote attackers to bypass authentication and…