African small and medium-sized businesses (SMBs) are facing growing cybersecurity risks, with password-stealing attacks reportedly rising by 51% over the past year, according to research from cybersecurity firm Kaspersky.
The increase comes as 82% of SMBs in the Middle East, Türkiye and Africa (META) region reportedly experienced at least one cybersecurity incident over the same period.
Kaspersky said the findings challenge the assumption that smaller organisations are less likely to be targeted by cybercriminals.
As businesses digitalise and the cost of launching cyberattacks falls, threat actors are increasingly targeting growth-stage companies and exploiting gaps in their defences.
The analysis also reported a 16% increase in spyware detections and a 23% rise in backdoor detections across Africa.
“These types of malware are commonly used to infiltrate corporate environments, steal confidential information, establish persistent access, and facilitate subsequent stages of targeted attacks. Exploits also remain a major issue for businesses,” Kaspersky said in the analysis.
In Nigeria, Kaspersky reported blocking more than 1.6 million online attack attempts in the first half of 2026, including attacks involving password stealers, exploits and spyware.
A further 2.5 million on-device threats, including malware spread through infected USB drives, were intercepted in Nigeria.
Within the META region, phishing and software vulnerability exploits were each encountered by 19% of SMBs, followed by weak or stolen credentials at 18% and vulnerabilities in external remote access at 16%.
Globally, phishing was the most frequently encountered breach among SMBs at 20%, followed by software vulnerability exploitation at 17% and external remote access at 16%.
Ilya Markelov, head of the Unified Platform Product Line at Kaspersky, said businesses of all sizes could be targeted using multiple attack methods.
“Sophisticated attacks easily bypass fragmented defences, requiring advanced tools and a skilled team to counter them. However, growing companies are often held back by budget constraints and the global InfoSec talent shortage,” Markelov said.
“That is why modern cybersecurity solutions must deliver more with less. Instead of introducing complex new tools that demand hard-to-find, expensive expertise, vendors should focus on cutting complexity.
'When designing our products for SMBs, our goal is to provide advanced protection that is easy to adopt, simple to manage, and able to grow alongside the business, helping organisations strengthen their security without adding unnecessary complexity or stretching their budget.”
The findings come as African businesses continue to face rising cyberthreats. Kaspersky previously reported a 26% increase in password-stealer detections across Africa between 2023 and 2024, with Kenya, Morocco and South Africa recording the highest numbers of detected attacks.
Kaspersky's latest research also highlights the growing use of emerging technologies and familiar digital services as lures against smaller businesses.
In June, the company reported that attacks on SMBs involving malware disguised as popular AI services had increased almost fivefold in the first four months of 2026 compared with the same period in 2025.
Share
