Kaspersky’s small-business threat report for the first four months of 2026, published in late June, logged more than 33,300 attacks that reached small-business endpoints through fake AI-tool downloads — nearly five times the volume the same researchers tracked in the same window of 2025. The attack pattern is not the usual “adversaries wielding AI.” It is malware disguised as the AI tools employees are already actively looking for. A staff member types a query like “download the popular AI assistant” into a search bar, clicks the first result that looks like the official landing page, runs the installer, and hands attackers a foothold on a managed workstation that was otherwise well-configured.

That distinction matters because a fake AI installer bypasses every control small businesses lean on hardest. The email filter never sees the payload. Multi-factor authentication is not challenged because the user is already signed in to the workstation. Browser warnings do not fire because the destination page looks and behaves like a legitimate software vendor’s site. This is a different attack surface from the phishing and credential-theft patterns that dominate cybersecurity coverage. It lands the same week the Five Eyes AI-attack advisory the alliance issued in June reminded small business owners that automated attacks are about to step up, and it puts a concrete operational data point behind the strategic warning.

How Big Is The Fake-AI-Tool Attack Wave, Really?

The Kaspersky research covers January through April of 2026 and counts unique attacks logged against small-business endpoints where the delivery mechanism was an installer masquerading as a well-known AI product. The 33,300 figure is not a projection or an extrapolation. It is the number of separate blocked or observed installations across the researchers’ visibility network in a single four-month window. Applied against a full calendar year at the current trajectory, the pattern is on track to produce more than a hundred thousand recorded incidents.

The payloads inside the installers are conventional. Researchers documented information stealers that harvest saved browser passwords and session cookies, remote-access trojans that give an operator interactive control over the workstation, and ransomware droppers that stage encryption for a later trigger. What is new is the wrapper. The wrapper is a working — or working-enough — version of the AI tool the employee wanted to install. The user runs the “AI assistant,” it responds to prompts using real API calls to a public model, and the malware executes in a separate service the user never sees.

Kaspersky’s ranking data shows the fake landing pages routinely outperform legitimate vendor pages in search results during launch windows and news cycles for popular AI products. That timing is deliberate. Attackers spin up the pages in the hours after a public launch announcement, buy small ad placements against launch-related queries, and count on the employee’s urgency to overtake the employee’s caution.

Why Is This Growing Five Times Faster Than Before?

Two forces compound. The first is the pace of new AI product releases. Every few weeks a fresh AI assistant, coding helper, meeting transcriber, or image generator arrives with strong buzz. Employees search for the tool by name, in a browser, on a workstation, without asking IT. The second is the collapsing cost of producing a convincing lookalike. Attackers can clone a vendor’s landing page, wrap a small legitimate front-end around a working API call, generate installer binaries with fresh code-signing gymnastics, and rank the whole package in front of the real one — in hours rather than weeks. The number of AI product launches multiplied by the falling per-launch cost of running the impersonation kit produces the five-times-year-over-year curve Kaspersky is measuring.

Which AI Tool Categories Are Attackers Cloning Most?

Five categories dominate the observed campaigns. AI chat assistants for research and customer service. AI coding assistants aimed at developers on the team. AI meeting transcribers that promise to summarize calls automatically. AI image and video generators for marketing teams. And AI browser extensions that add sidebar features to a browser the employee already uses every day. All five sit outside the productivity suites most small businesses already license, which is why staff typically go looking for them from personal search sessions instead of from an approved-software catalog. The gap between “we already own Microsoft 365 or Google Workspace” and “we do not have an approved list of AI add-ons for those platforms” is where shadow AI lives.

Why Doesn’t MFA Or AV Catch A Fake AI Installer?

The controls small businesses invested in over the past three years — MFA on every login, modern endpoint antivirus, phishing-resistant browsers — were built around the assumption that the attacker has to get past the user. A fake AI installer inverts that assumption. The user is not being tricked into clicking a link in an email. The user is actively looking for the software, finds something that behaves like the software, and installs it on purpose. Every layered defense that keys off “did the user consent” quietly answers yes.

The Install Happens With The User’s Own Consent

Windows and macOS both treat an installer that the signed-in user chose to run as authorized. The elevation prompt for local administrator rights fires, the user clicks Yes because they wanted the tool, and the payload runs with everything the user’s account can reach. There is no policy gate that catches “the user ran an installer they shouldn’t have,” because from the operating system’s perspective, no rule was broken. Business-grade antivirus adds behavioral analysis on top, which catches some payloads, but the packing and evasion techniques on the newest fake installers turn over weekly. A workstation that is clean on Monday can be running an infostealer on Wednesday and back to a clean-looking behavioral profile by Friday.

The Malware Ships With A Working AI Wrapper

The characteristic that separates the current wave from earlier fake-software campaigns is the quality of the decoy. Modern fake installers include a small legitimate front-end that either makes real API calls to a public language-model endpoint or wraps a local open-source model. To the user, the tool works. It responds to prompts, generates images, transcribes a meeting, or writes code. The employee uses the tool for the next several weeks, tells a coworker about it, and never opens a support ticket about anything feeling wrong. Meanwhile the persistence, credential harvesting, and beaconing runs as a separate background service on the same workstation. This is a materially different attacker capability from the “obvious fake” installer landscape of 2023 and 2024, and it is why endpoint-only defenses are not catching the shift.

How Do You Audit The AI Tools Running In Your Business?

Three inventories, done in sequence, give a small business owner an accurate picture of shadow AI within a single working week. None of them require new software purchases. All of them require a written list at the end.

Start With An Installed-Applications Inventory

On Windows workstations, this is either an existing remote monitoring report, a group policy audit, or — for a very small office without either — a per-machine review under Settings, Apps, and Installed apps. On macOS it is the Applications folder plus the Login Items list. Look for anything AI-branded that does not appear on an approved list at the time of install. Anything installed in the last 90 days from an unfamiliar publisher deserves a closer look. Anything that names a specific AI product but is code-signed by a publisher your team does not recognize should be treated as suspicious until proven otherwise. Do the same review for browser extensions in every browser your team uses, because a sidebar extension can quietly exfiltrate the same session data an installed application would.

Cross-Check With The Cloud SaaS Grants List

Many AI tools ask for OAuth access into a productivity suite (Microsoft 365 or Google Workspace) or the customer relationship management system to read email, calendars, contacts, or documents. That grant list is separate from the installed-application inventory and is another common shadow AI vector, with the added risk that the AI grants tend to ask for read-everywhere scopes. Open the Enterprise applications page in Microsoft Entra, or the API controls page in the Google Workspace admin console, and inventory every third-party app that carries an AI-related name or that was authorized after the workspace’s last audit. The same audit that catches shadow SaaS integrations that no one is watching catches AI-branded ones, with the difference that the AI grants often were approved on purpose by an employee who wanted the feature and did not know they were also handing over calendar and mailbox read access.

The Four Questions Every AI Install Should Answer

For every AI tool that surfaces in either inventory, answer four questions before deciding whether it stays. First, who is the publisher, and is the installer code-signed by the same organization that owns the product’s public brand? Second, what data does the tool read from the workstation, the cloud tenant, or the CRM, and does that scope match what the employee actually needs the tool to do? Third, does the tool phone home to servers your IT team recognizes, or to unfamiliar hosts your outbound traffic reports have never seen before? Fourth, is the tool on the company’s approved-software list, and if not, who approved it and when? Any tool that fails one of these gets flagged for follow-up. Any tool that fails two gets removed and the endpoint gets a fresh baseline scan.

What Should Your IT Partner Do About Shadow AI Now?

The audit is the picture of what is already installed. The following controls close the door on what gets installed next, and they are the specific behaviors a managed IT partner delivers between audits.

Enable Endpoint Application Control

Modern endpoint tooling supports either allowlisting (only permitted publishers or file paths are allowed to execute) or blocklisting (specific known-bad publishers or file paths are blocked). Allowlisting is more restrictive and requires more maintenance, but it stops shadow AI installs at the operating system level rather than after the fact. For businesses without the appetite for full allowlisting, a starter policy that blocks unsigned installers from user-writable folders, requires an administrator ticket to install anything not on the approved list, and quarantines any executable that reaches out to an unrecognized cloud host closes roughly eighty percent of the risk without a major behavior change for the user.

Stand Up An Approved AI Tools Catalog And Review Path

The reason staff bypass IT for AI tools is that they need the tool this week and IT feels slow. A short, published catalog of “these AI tools are approved, these are being reviewed, and requests for new ones go here” removes most of the incentive to shadow-install. Pair the catalog with a five-business-day review commitment for new requests. Business owners who resist this on the grounds that IT should say yes to everything typically discover their shadow AI installs the hard way, in a recovery meeting, three months after the workstation was already reporting to an unfamiliar host. The review process is dramatically cheaper than the incident, and the catalog is one of the highest-leverage documents a small business can maintain in a year with weekly new AI launches.

Continuous Monitoring For Shadow AI Signals

A partner running 24/7 monitoring your small business’s endpoints for install events, elevation prompts, new browser extensions, new outbound cloud grants, and unfamiliar egress hosts will catch a shadow AI install within days rather than months. Monitoring is not free, but the incident bill from a single infostealer that captured six months of saved passwords, session cookies, and CRM records is orders of magnitude higher than the monitoring subscription. A written playbook for what happens when a shadow AI install is detected — from ticket creation through remediation and the follow-up conversation with the staff member — turns discovery into a routine cleanup rather than a fire drill, and it is one of the specific artifacts a mature managed cybersecurity program produces.

For businesses that do not yet know what is installed across their fleet, the fastest starting point is a free security risk assessment for your business that inventories current endpoints, cloud OAuth grants, and browser extensions, then prioritizes what to close first. The output is a written list of what was found and what should be removed. Change begins with the list.

Where Should A Small Business Start With Shadow AI?

Start with three artifacts in the next five business days. First, an installed-applications and browser-extension inventory across every managed workstation, with any AI-branded item from the last ninety days flagged for review. Second, a screenshot or export of every third-party OAuth grant against the Microsoft 365 or Google Workspace tenant, with the AI-related grants highlighted. Third, a one-page approved-AI-tools list published to the team with a named path for requesting a new tool. Those three artifacts, together, close the fastest-moving new attack surface of 2026 for most small businesses.

The controls that stop the next shadow AI install — endpoint application control, a review workflow, and continuous monitoring — take longer to stand up. Start the three-artifact inventory in parallel with the longer-cycle controls, because the inventory reveals what needs to happen this month rather than next quarter. A forty-five-minute conversation with your managed IT team is enough to translate the Kaspersky data into a written plan for your specific environment, including which endpoints to scan first and which AI tools your team is likely already using without a paper trail.

Frequently Asked Questions

What Counts As A “Shadow AI Tool” In A Small Business?

Any AI software or browser extension installed on a business-owned device, or granted access to business cloud accounts, without going through the company’s IT review process. That includes free-tier signups an employee started on their own, browser sidebar extensions that added themselves during a browser update, desktop installers pulled directly from a search result, and OAuth-connected AI chatbots authorized from a personal login on a work machine. The common thread is that no one in a documented role approved the tool before it began reading company data.

Doesn’t Blocking AI Tools Hurt Employee Productivity?

The point is not to block AI use across the board. The point is to move AI use from unmanaged shadow installs to a reviewed, approved list that staff can use with confidence. Most of the tools employees are quietly installing today would pass a review process; a few would not. The difference is knowing which is which. A well-run approved list actually accelerates productive AI use because employees stop hesitating on which tool is safe to try and start using the ones the company has already vetted.

Are We Too Small For Endpoint Application Control?

The starter version of endpoint control does not require enterprise tooling. Blocking unsigned installers from user-writable folders, requiring administrator approval for new software, and reviewing installed apps monthly are baseline controls available on any Windows Pro or Mac deployment. Full allowlisting is the enterprise version; the small-business version is a written policy plus a monthly review plus one policy setting change in the group policy or configuration profile. Any business with five or more managed workstations can implement this without a new tooling purchase.

Should We Worry About Staff Using AI On Personal Phones?

Yes, but the enforcement path is different. Business data should not flow into personal AI apps regardless of the device. A written acceptable-use policy that names AI tools specifically, paired with mobile device management for any personal phone that has access to company email or CRM data, is the small-business version of the enterprise control. A short, direct policy paragraph on personal-device AI use, combined with a five-minute team conversation about why the policy exists, closes more risk than a technical control alone.

How Often Should We Audit Installed AI Tools?

Monthly for the installed-applications inventory and browser extensions across every managed workstation. Quarterly for the cloud OAuth grants list in Microsoft 365 or Google Workspace and the CRM. Immediately whenever there is a major new AI product launch that generates news coverage, because that is when shadow installs spike. A written schedule that names the owner of each audit and the date it was last completed turns audit hygiene from an aspirational habit into a repeatable operational task.

What Is The Single Most Useful Control To Add This Week?

A written, published approved-AI-tools list, paired with a five-business-day commitment to review new requests. The list itself does not stop attacks. It stops the pattern in which staff feel they have no legitimate path to the tool they need and go looking for one on their own. Every subsequent control — endpoint application control, monitoring, incident response — is much easier to enforce once employees know there is a fast approved path they can use instead of going around the process.