Kaspersky is flagging a sharp rise in global cyberthreats after its systems recorded an average of 500,000 malicious files every day in 2025, a 7% jump from the previous year, the company said in a press release.
Windows users bore the greatest risk, with nearly half of them targeted, while Mac users made up just under a third of total detections.
Web-based attacks accounted for more than a quarter of all incidents worldwide, but on-device threats spread through USBs, discs and hidden installers remained even more common.
The threat landscape shifted noticeably over the past year as password stealers surged 59% and spyware detections climbed 51%, outpacing the 6% increase in backdoor activity.
Analysts observed that APAC and Europe experienced the most dramatic spikes, although Latin America, Africa and CIS regions also faced persistent growth in malware.
Kaspersky Head of Threat Research Alexander Liskin said cyberattacks had become more sophisticated, pointing to the resurfacing of the Hacking Team under a new identity and its Dante spyware’s use in the ForumTroll APT campaign.
He noted that attackers continued to exploit software vulnerabilities and stolen credentials to break into corporate systems, driving the global rise in password stealers and spyware.
Supply-chain breaches also expanded, with the first widespread NPM worm, Shai-Hulud, highlighting how open-source ecosystems are being increasingly targeted.
The bulletin warned that organisations without strong cyber-resilience strategies could face prolonged disruption from attacks that now take months to recover from.
Individuals were urged to rely on trusted security tools, enable two-factor authentication, update devices quickly and avoid unfamiliar links and downloads.
The advisory also encouraged users to adopt password managers and ignore any prompts to disable security protections.
Companies were reminded to secure remote desktop services, keep software patched and maintain isolated backup systems to safeguard operations.
The findings draw on data from the Kaspersky Security Network, covering the period between November 2024 and October 2025.
