In this article
The bottom line In 2026, the attacks that hit Algerian SMEs are not the most sophisticated ones, they are the most profitable: a well-written message, a stolen password, a missing backup, a transfer approved too quickly. Four threats account for most of the risk. Knowing them already reduces your exposure.
The context in 2026
Public figures give the order of magnitude. Kaspersky reports blocking more than 13 million phishing attempts in Algeria in 2024. The police recorded more than 13,000 cybercrime cases in 2025. Interpol's Africa report, published in June 2025, ranks phishing scams as the most reported offence and notes the rise of CEO fraud.
The framework has changed too. The 2025-2029 national cybersecurity strategy was adopted at the end of 2025, and decree 26-07 now requires a cybersecurity unit in every public body. Private companies are not directly covered, but their public clients will ask more of them.
Threat 1: AI-written phishing, in French and Darija
Phishing in 2026 has no spelling mistakes. Text generation tools produce flawless messages, in French as well as Darija, imitating your bank, your telecom operator, a courier or your own IT department.
The formats that work best: fake delivery notices by SMS, fake WhatsApp messages from an "IT manager" asking for a code, fake PDF invoices leading to a login page copied pixel for pixel.
Protection: train teams with real, recent examples, require verification through a second channel for any request for credentials or payment, and turn on two-factor authentication on all critical accounts.
Threat 2: stolen credentials and exposed remote access
An attacker no longer needs to "hack" a server if they can log into it. Credential-stealing malware, installed through an attachment or software downloaded outside official channels, collects the passwords saved in browsers. Those credentials are then resold.
They are used first against remote access left open on the internet: Windows Remote Desktop (RDP), VPNs without two-factor authentication, webmail. Many companies opened these during the 2020 lockdowns and never closed or secured them.
Signs of exposure: a server reachable over RDP directly from the internet, a VPN protected by a single password, accounts of former employees still active.
Protection: put RDP behind a VPN, require two-factor authentication on all remote access, lock accounts after repeated failures, and disable accounts as soon as someone leaves.
Threat 3: ransomware
Ransomware encrypts your data and demands a ransom to restore it. "Ransomware as a service" lets low-skilled groups launch these attacks, and SMEs are prime targets: valuable data, few defences, and strong pressure to get back to work fast.
The entry points are almost always the same: a booby-trapped message, stolen remote access (see threat 2), a server that was never updated. Most incidents are never made public, which feeds the false idea that "it only happens to others".
Protection: tested backups, including an offline copy, updates applied without delay, a segmented network so one infected machine does not contaminate everything, and a written response plan before the incident.
Threat 4: payment fraud, now with a voice
CEO fraud and fake supplier bank detail changes remain the attacks with the most direct cost. The scenario: a message or call from a fake executive, fake finance director or fake supplier, asking for an urgent transfer or a change of bank details.
What is new is voice cloning. A few seconds of a manager's voice, taken from a public video, are enough to produce a convincing voice message.
Protection: mandatory double approval for any transfer and any change of bank details, a call back on a number already on file (never the one in the message), and a culture where checking a request from the boss is normal, not out of place.
What these 4 threats have in common
None relies on an exotic technical flaw. They exploit habits, missing procedures and poorly managed access. An antivirus alone does not stop them. What works: simple procedures that everyone follows, controlled access, verified backups, and a regular look at the company's real exposure.
Frequently asked questions
What should we do after a ransomware attack?
Isolate the affected machines from the network immediately, without switching them off if possible. Do not pay the ransom before assessing every option. Call in an incident response specialist. Check the state of your backups before any restore. Document every step, for the complaint as well as for insurers. The first hours decide how much damage is done.
Who do you report a cyberattack to in Algeria?
A cyberattack is an offence: a complaint can be filed with the police or the gendarmerie, which have units specialised in cybercrime. The Information Systems Security Agency (ASSI) is the national body in charge of information systems security, in particular for institutions and critical infrastructure. If personal data is affected, the national personal data protection authority (ANPDP) is also concerned.
Does decree 26-07 apply to private companies?
Not directly: it covers public institutions, administrations and bodies. But a company working for them, as a supplier or subcontractor, should expect security clauses in its contracts and to have to show its own measures.