Cyberattacks are evolving as threat actors are getting smarter as they’re increasingly relying on generative Artificial Intelligence to commit business fraud or cause operation disruptions. Reports indicate that hackers are getting younger too, with teenagers driving high-damage scams like account takeovers and distributed Denial-of-Service (DDoS) attacks. As cybercriminals continue to target small businesses, it is estimated that worldwide cybercrime costs will grow by 15 percent per year over the next 24 months, reaching $10.5 trillion globally this year.
Previous studies have shown that businesses that have fallen victim to a cybercrime rarely survive as they go out of business within six months after a data breach or cyberattack. Whether you’re a startup leader or an owner of a growing brand, it’s important to be aware of the latest scams and illegal online operations to prevent your business from going under. Here are the latest cybersecurity threats that entrepreneurs can’t afford to ignore.
AI-Driven Social Engineering and Phishing
In response to intensified cyberattacks, some businesses are fortifying their systems by installing cybersecurity tools and using VPNs to protect sensitive company files. While certain cybersecurity solutions can help create a secure network, using VPNs can backfire as it offers incomplete protection against scammers. There have been recorded instances which proved that VPN has weak spots since it only secures a business’s connection from local snoopers, but it cannot protect against common cybercrimes like malware or phishing attacks.
Back in the day, cybercriminals used to manually send fraudulent emails or text messages to orchestrate phishing scams. But lately, attackers are using plug and play AI-enabled tools sourced from the dark web to automate manipulative and personalized cyberattacks. This involves using AI to scan corporate filings, public databases, social media, and past data breaches to build a target’s operational profiles. Then, they use Large Language Models to draft phishing emails tailored to a specific employee’s role, writing style, or relationship with workers. These completely eliminate telltale indicators of phishing emails, such as awkward greetings, bad spelling and grammar, or odd phrasing and tone.
Other disturbing tactics that malicious actors use nowadays are audio and video deepfakes. Through AI voice cloning, cybercriminals can reproduce an executive’s voice with audio sourced from public videos or official social media pages. They can also create video deepfakes that simulate human appearance and body language, so the deepfake can interact in real-time with employees without them knowing that they’re being fooled. One documented instance of a deepfake incident happened in 2024, and according to a CNN report, a Hong Kong-based finance worker was duped into remitting about $25 million after a video call with a deepfaked chief financial officer. The scam was only discovered when the employee later checked with the corporation’s head office.
Preventing AI-driven scams requires doing verifications the old fashioned way. To confirm high-risk actions like wire transfers or changes to bank details, call or text the sender using an established and trusted phone number. Require two independent human approvals for major transactions, and establish verbal phrases for colleagues to authenticate requests.
AI Agents Going Rogue
It’s distressing enough that hackers are using AI to target businesses, but it looks like things are getting worse as it appears that some AI agents have the capability to hack into systems even without human involvement. According to a recent World Economic Forum report, AI organizations Anthropic and OpenAI have both reported that their AI agents have found a way to access various companies’ systems during tests. Meta has also reported that one of its models has autonomously connected to the Internet to hack an unnamed firm.
To protect your business from autonomous AI cyber attacks, you’ll need to treat internal AI tools and agents as least-privileged users rather than just simple tools. Restrict their access to only the specific data that they need to do their job and use short-lived credentials. Consider fighting AI with AI by integrating AI-driven tools that can analyze anomalies, flag threats, and respond at the same or even greater speed than an autonomous attacker. Also, have a backup plan in place in case your AI solution fails. It’s a good idea to have physical kill switches so you can immediately severe rogue AI agents’ access if they behave maliciously. For instance, you can automatically cut electrical power by having an expert install an Industrial E-Stop button directly into the power feed of the AI server. This stops the agent from communicating with external databases, sites, and other servers.
Cyber attackers are using more sophisticated strategies to scam businesses and organizations. Stay one step ahead of threat actors by learning all about the latest cybersecurity threats so you can avoid becoming a victim of AI-powered cons.