Kaspersky reports that malicious files detection averaged 500,000 files per day in 2025, up 7% year on year. The latest Kaspersky Security Bulletin 2025 shows steep growth in password stealers, spyware and backdoors. Windows users were hit hardest, with rising on-device and online threats across all regions.
The report indicates 59% growth in password stealers and 51% in spyware, underscoring intensified credential theft and surveillance. Backdoors rose 6%, supporting sustained persistence and lateral movement.
Online threats reached 27% of users, while 33% encountered on-device risks via removable media and complex installers. These metrics position malicious files detection as a frontline control for enterprise defence.
Malicious Files Detection: What You Need to Know
- 500,000 daily detections, a 59% password stealers malware increase, and expanding spyware and backdoor activity define the 2025 threat landscape.
- Bitdefender – Endpoint protection with behavioural detection to stop file-based malware early.
- 1Password – Enterprise password manager to cut credential reuse and phishing risk.
- Passpack – Team password sharing with audit trails for regulated environments.
- IDrive – Encrypted cloud backup to recover quickly from ransomware and wipers.
- Tenable Vulnerability Management – Prioritise patching against active exploits and misconfigurations.
- EasyDMARC – Email authentication (DMARC, DKIM, SPF) to block spoofing and BEC.
- Tresorit – Zero‑knowledge, end‑to‑end encrypted storage for sensitive files.
- Optery – Remove exposed personal data from broker sites to reduce targeting.
Inside the Kaspersky Security Bulletin 2025
The Kaspersky Security Bulletin 2025 records half a million threats flagged daily, confirming a sustained rise rather than a brief spike in activity.
Malicious files detection supports faster triage of high‑risk artefacts, reducing dwell time and enabling earlier incident response.
The most significant trend is the password stealers malware increase of 59%, followed by a 51% rise in spyware and 6% in backdoors.
These classes directly erode identity and access controls, enabling credential compromise, covert surveillance and persistent access, areas where malicious files detection is critical to surface hidden footholds.
Where attacks are rising fastest
Regional data shows APAC with a 132% surge in password stealers. Europe reported a 50% rise in backdoors and a 64% jump in spyware. Africa and LATAM recorded substantial gains across password stealers and spyware.
The Middle East saw 26% growth in password stealers and 37% in spyware, while the CIS posted 67% and 68% increases respectively. For Africa-focused context on social engineering, see this analysis of phishing and compromised-password attacks.
Platforms under pressure
Windows remains the primary target, with 48% of users affected. Mac users were not immune, with 29% facing attacks. Online threats hit 27% of users, while 33% encountered on-device activity from removable media and complex installers.
Cross‑platform exposure underscores why malicious files detection is essential across heterogeneous fleets and BYOD estates.
Evolving tactics: spyware, stealers and backdoors
Spyware and credential theft tools are increasingly modular and stealthy, enabling lateral movement and persistent access.
The pronounced password stealers malware increase indicates a broad campaign against identity.
Organisations should strengthen detection for browser credential stores, MFA fatigue and token theft, and review credential exposure mitigation strategies.
Supply chain and zero-day exploits move centre stage
Kaspersky tracks the reappearance of Hacking Team tooling via Dante spyware in the ForumTroll APT campaign, coupled with zero‑day exploitation against Chrome and Firefox.
Supply chain risk is rising, illustrated by the first widespread NPM worm, Shai‑Hulud. For additional background, review this NPM supply chain attack overview and this Chrome zero‑day summary.
These developments demand tighter code provenance checks and robust malicious files detection across CI/CD and developer endpoints.
How to reduce risk today
- Install software only from verified publishers; avoid untrusted apps and links.
- Enable multi‑factor authentication and use unique, strong passwords in a reputable manager.
- Patch operating systems, browsers and plugins promptly to limit exploit windows.
- Deploy layered controls that combine endpoint protection, EDR/XDR and current threat intelligence.
- Limit publicly exposed remote services, maintain isolated, tested backups, and enforce least‑privilege access.
For deeper context on stealers, read this primer on infostealer malware. For prior regional telemetry, see Kaspersky’s findings on Nigerian users.
Implications: what the surge means for users and organisations
Rising credential theft, spyware and backdoors increase both breach frequency and impact. At scale, malicious files detection generates richer telemetry, enabling earlier containment and improved threat hunting.
This visibility advantage can reduce attacker dwell time and data loss.
The trade‑off is operational load. Higher alert volumes demand tuned detections, context‑aware enrichment and skilled analysts to separate signal from noise.
Without process maturity, teams risk fatigue that attackers can exploit through staged, low‑and‑slow campaigns.
- Auvik – Network monitoring and mapping to spot anomalies and rogue devices fast.
- Tenable Nessus – Proven scanner for vulnerabilities, misconfigurations and policy drift.
- Bitdefender – Advanced endpoint defence with anti‑ransomware capabilities.
- 1Password – Secrets management and SSO integrations for secure access at scale.
- IDrive – Immutable backups and rapid recovery for business continuity.
- EasyDMARC – Stop spoofed domains and reduce phishing blast radius.
- Tresorit – Encrypted collaboration for regulated data and cross‑border teams.
- Optery – Automate PII removal to cut targeted attack risk.
Conclusion
Kaspersky’s 2025 telemetry confirms malicious files detection as a baseline control as attackers scale credential theft, spyware and backdoors. The data shows persistent campaigns against identity and access.
Regional spikes from APAC to Europe and Africa require locally tuned detections with global oversight. Strengthening hygiene, patching discipline and layered controls limits attacker leverage and improves resilience.
With zero‑day exploitation and supply chain compromise rising, pair rapid patching and restricted exposure with immutable backups and integrated endpoint controls. Combining malicious files detection, updated software and robust access management offers the best chance to stay ahead. Related guidance: ransomware fundamentals and FAQs.
Questions Worth Answering
How many malicious files did Kaspersky detect daily in 2025?
- An average of 500,000 per day, representing a 7% increase over 2024.
Which threats grew the most this year?
- Password stealers rose 59%, spyware increased 51%, and backdoors grew 6% globally.
Which platforms were targeted most?
- Windows saw the most activity at 48% of users; 29% of Mac users faced attacks.
What is driving on-device threats?
- Removable media and complex installers contributed to 33% of users facing on‑device threats.
Which regions experienced the sharpest rises?
- APAC recorded a 132% jump in password stealers; Europe saw backdoors up 50% and spyware up 64%.
What emerging tactics are highlighted?
- Dante spyware use in ForumTroll APT activity, zero‑days in Chrome and Firefox, and the Shai‑Hulud NPM worm.
What immediate steps should organisations take?
- Update software, reduce exposed services, deploy layered endpoint controls, use current threat intel, and maintain isolated, tested backups.
About Kaspersky
Kaspersky is a global cybersecurity vendor specialising in threat intelligence, endpoint protection and detection technologies for enterprises and consumers.
Its research teams track malware, spyware, backdoors and zero‑day exploitation across regions and platforms, publishing frequent technical analysis.
The company issues annual bulletins, including the Kaspersky Security Bulletin 2025, and offers solutions designed to reduce cyber risk at scale.