Partner content

Kaspersky outlines phishing and email spam lures targeting businesses and entrepreneurs in 2026

At the beginning of 2026, Kaspersky researchers observed a wide range of phishing campaigns and scams targeting businesses and entrepreneurs. In these campaigns, attackers impersonate financial, AI services and other brands in order to steal credentials and corporate information, as well as funds.

Ahead of International SMB Day on June 27, a new Kaspersky report reveals threat analysis and mitigation strategies to help SMBs protect themselves against the evolving threat landscape.

In 2026, schemes in which scammers masquerade as financial organizations, allegedly offering services for business or business loans, are widespread. Entrepreneurs are prompted to visit a scam website and provide their data to open a business account or apply for a loan. The list of data depends on the scam scheme and can include the victim’s name, email address, phone number, social security number, date of birth, as well as address information.

Business accounts on social networks and in messengers remain an attractive target for phishers. In the schemes observed by Kaspersky experts, attackers, under various pretexts, threatened victims with blocking their social media accounts; in others, they offered to verify a business account. But in any case, phishers used these scenarios to steal corporate account credentials.

“Fraudsters can potentially use stolen data from businesses or entrepreneurs in their schemes or sell it on the dark web market. As for compromised corporate accounts on social networks or in messengers, attackers can use them for fraud targeting customers of the affected business. Employees and business owners should remember: if you encounter a suspicious website, don’t rush to enter any data or credentials. First, examine it: does the organization actually exist? How old is the website? Check WHOIS records and users’ reviews before entering anything on the page”, says Olga Altukhova, cybersecurity expert at Kaspersky.

Email also remains one of the most widely used channels for cyberattackers targeting businesses, including small and medium-sized ones. In 2026 Kaspersky experts frequently observed fake emails prompting victims to access various online documents — allegedly from HR or accounting departments. Fraudulent emails in which corporate users were supposed to review details about a supposed cargo delivery, compliance issue, invoice payment or product offer have also been detected. But in reality, if users clicked on the link or opened a file attached to such emails, they risked losing corporate data on phishing resources or infecting their device with malware.

“In 2026 attackers frequently distribute emails using various legitimate third-party services, for example, collaboration or survey platforms. This helps phishers and scammers attempt to bypass traditional email filters and exploit user trust in reputable brands. The lures — the subjects and texts — of malicious or phishing emails can appear relatively harmless and even quite trivial, as in the schemes attackers may use everyday topics that corporate users constantly encounter in their daily correspondence. But in reality, fraudulent emails can pose a serious cyberthreat to corporate data and devices. Therefore, email protection and improving employees' digital literacy should remain among the priorities for businesses, including small and medium-sized ones”, adds Anna Lazaricheva, senior spam analyst at Kaspersky.