How Cybercriminals Are Using AI to Target Businesses
How Cybercriminals Are Using AI to Target Businesses
AI is changing the way businesses work. Unfortunately, AI cybercrime is also changing the way businesses are attacked.
It is helping teams write faster, summarise information, improve workflows and reduce time spent on repetitive admin.
But businesses are not the only ones using it.
Cybercriminals are using AI too.
That does not mean every attacker is now running fully autonomous cyber operations. The reality is more practical, and in many ways more concerning.
AI is making familiar attacks faster, more convincing and harder to spot.
Phishing emails can be better written.
Impersonation attempts can be more tailored.
Reconnaissance can happen more quickly.
Malware development can be supported by AI tools.
Voice cloning and deepfake video can make social engineering feel much more believable.
For business owners, the message is not panic.
It is preparation.
The cyber security basics still matter, but they now need to stand up against AI cybercrime that is quicker, more polished and more difficult for staff to recognise.
AI Is Changing the Economics of Cybercrime
Cybercrime has always relied on time, effort and scale.
Attackers need to research targets, write convincing messages, identify weaknesses, create urgency and persuade someone to take action.
AI cybercrime supports many of those steps.
It helps attackers work more quickly, communicate more convincingly and research potential targets at scale. The concern is not that criminal groups have become fully autonomous. It is that existing methods are becoming easier to run, harder to recognise and more effective when combined with human judgement.
That distinction matters.
AI does not need to invent a completely new type of cyberattack to create risk.
It can make existing attacks better.
And for many small and mid-sized businesses, that is enough to increase exposure.
AI Cybercrime Is Making Phishing Emails More Convincing
Phishing remains one of the most common ways attackers try to gain access to a business.
Traditionally, many phishing emails were easier to spot because they contained obvious mistakes.
Poor grammar.
Strange formatting.
Unnatural wording.
Generic messages.
Suspicious urgency.
Those warning signs still exist, but AI is making them less reliable.
AI can improve the quality of a message, adapt its language to a particular recipient and produce many variations in a short period of time. An attacker no longer needs to rely on an obviously suspicious email.
That means a phishing email might:
- Sound more natural
- Use better spelling and grammar
- Refer to a current project
- Imitate a familiar writing style
- Create urgency around an invoice
- Ask about a real customer or supplier
- Look like part of an existing conversation
This makes staff awareness more important than ever. Our guide to how hackers trick your team covers the email security essentials every business should have in place.
Employees cannot rely only on spotting spelling mistakes.
They need to understand process, context and verification.
Business Email Compromise Is Becoming Harder to Spot
Business Email Compromise, often called BEC, is one of the most damaging forms of cybercrime.
It usually involves attackers impersonating a senior colleague, supplier or customer to influence a financial or information-handling decision.
For example, an attacker might send an email that appears to come from:
- A director asking for an urgent payment
- A supplier requesting new bank details
- A customer asking for confidential information
- A senior manager asking for login credentials
- A colleague sharing a link to a fake document
AI cybercrime makes these attacks more convincing.
AI-generated text can support the initial email exchange, while publicly available information helps the attacker make the request appear plausible.
The final action may still depend on a human pressing send, changing details or approving a payment.
But the preparation behind the deception can now be faster and more tailored.
That is why businesses need strong verification processes.
A convincing email should never be enough on its own when money, credentials, supplier details or confidential information are involved.
Voice Cloning and Deepfakes: AI Cybercrime Gets Personal
Email is not the only concern.
AI can also support voice cloning and deepfake video.
This creates a serious challenge because many businesses still rely on familiarity as a form of verification.
They think:
“I recognise the voice.”
“I saw them on the call.”
“The message sounded like them.”
That is no longer enough.
In a widely reported 2024 incident involving Arup in Hong Kong, an employee was deceived by AI-generated audio and video impersonations of senior executives and transferred HK$200 million (around US$25 million). Arup described the incident as technology-enhanced social engineering rather than a compromise of its systems.
That distinction is important.
The company’s systems were not necessarily hacked in the traditional sense.
Instead, the attacker manipulated human trust.
Stronger firewalls alone would not have prevented the transfer.
The relevant control was a reliable process for verifying unusual payment requests through a separate channel.
For businesses, the lesson is practical.
When a request involves money, credentials, confidential information or changes to supplier details, familiarity is not enough.
Verification should rely on an agreed process, known contact details and more than one person where the potential impact is significant.
How AI Cybercrime Speeds Up Target Research
Many cyberattacks begin long before the first phishing email is sent.
Attackers often research a business first.
They may look at:
- Company websites
- LinkedIn profiles
- Supplier relationships
- Public documents
- Job adverts
- Technology clues
- Staff roles
- Recent news
- Social media posts
AI can help organise that information quickly.
It can support reconnaissance by summarising public information, identifying useful details and helping attackers tailor their approach.
Criminals and state-backed groups can use AI to organise information about a target, identify exposed technologies, draft social engineering material and analyse data taken from compromised systems.
This means AI cybercrime can feel much more personal.
A fraudulent email may reference a real supplier.
A phishing message may appear linked to a current project.
A fake request may be timed around a known event.
A social engineering attempt may use accurate names, roles and business context.
That makes verification even more important.
The more convincing an attack becomes, the less safe it is to rely on instinct alone.
AI Cybercrime and Malware Development
AI can also assist with more technical parts of cybercrime.
Assessments from the National Cyber Security Centre indicate that AI is already improving reconnaissance, vulnerability research and basic malware development. Human expertise is still expected to remain important in advanced operations, but automation increases the speed and reach of attacks.
That does not mean every attacker can suddenly build advanced malware.
But it does mean AI cybercrime has fewer barriers to entry.
It can help with:
- Researching vulnerabilities
- Drafting malicious scripts
- Producing variations of code
- Understanding technical documentation
- Analysing compromised data
- Supporting credential theft
- Automating parts of an attack
For business owners, the implication is simple.
Attackers may be able to move faster.
Your defences need to be maintained properly.
Familiar Security Controls Still Stop AI Cybercrime
It is easy to assume that AI-powered threats require completely new solutions.
In reality, many of the most important protections are familiar.
For SMBs, familiar security disciplines still matter. Prompt patching, strong identity controls, multi-factor authentication, tested backups, endpoint protection and staff awareness can reduce the opportunities attackers rely on. Payment verification and incident reporting processes are equally important because technical protection cannot address every deception.
That is worth repeating.
AI cybercrime may be changing the threat landscape, but the basics have not disappeared.
Businesses still need:
- Multi-factor authentication
- Strong password policies
- Email security
- Endpoint protection
- Regular patching
- Reliable backups
- User awareness training
- Access control
- Supplier verification
- Payment approval processes
- Incident reporting
The difference is that the margin for error is getting smaller.
If phishing emails are more convincing, staff need clearer guidance.
If impersonation attempts are more realistic, approval processes need to be stronger.
If attacks can be prepared faster, patching and monitoring become more important.
Why Staff Training Needs to Evolve for AI Cybercrime
Traditional cyber awareness training often focuses on obvious red flags.
Poor spelling.
Suspicious links.
Strange email addresses.
Unusual attachments.
Those still matter, but they are no longer enough.
Messages created through AI cybercrime may not look badly written.
They may not sound awkward.
They may not feel random.
Training needs to help staff think about behaviour and process.
For example:
- Is this request unusual?
- Is the urgency appropriate?
- Has the payment process changed?
- Are we being asked to bypass normal checks?
- Is the sender asking for confidential information?
- Has the request been verified through an approved channel?
- Are we relying only on a voice, video call or email?
The aim is not to make employees suspicious of everything.
It is to give them the confidence to pause, verify and escalate when something does not feel right.
Payment Verification Is Now Essential
Any business that makes payments, manages invoices or updates supplier details should have a clear verification process.
This is especially important as AI cybercrime makes impersonation more convincing.
A sensible process might include:
- Confirming bank detail changes using known contact information
- Requiring more than one approval for significant payments
- Never accepting urgent payment changes by email alone
- Recording approval decisions
- Training staff to challenge unusual requests
- Escalating anything that bypasses normal process
The key is to agree the process before something happens.
Staff should not have to decide under pressure whether a request is genuine.
The process should tell them what to do.
AI Cybercrime Is a Business Risk, Not Just an IT Risk
AI cybercrime affects more than the IT department.
It can impact:
- Finance teams
- HR teams
- Sales teams
- Customer service
- Operations
- Senior leadership
- Procurement
- Legal and compliance
- Supplier relationships
A fake payment request is a finance issue.
A deepfake call is a leadership issue.
A phishing email is a user awareness issue.
A compromised mailbox is an IT and security issue.
A leaked document is a governance issue.
This is why cyber security needs to be treated as a business priority.
Technology controls matter, but processes, people and leadership decisions matter too.
What Businesses Should Do Now
Businesses do not need to panic.
But they should act.
AI is increasing the speed and quality of certain attacks, which means organisations need to make sure their existing controls are strong enough.
A practical starting point would include the following.
1. Review email security
Make sure your business has proper protection in place for phishing, malicious links, attachments and impersonation attempts.
2. Enforce multi-factor authentication
MFA should be enabled across key systems, especially Microsoft 365, remote access, finance tools and administrator accounts.
3. Patch systems consistently
Known vulnerabilities should not be left open longer than necessary.
4. Review backup and recovery
Backups should be monitored, tested and suitable for a real incident.
5. Train staff on AI-enhanced threats
Awareness training should now include convincing phishing, impersonation, voice cloning and payment verification.
6. Strengthen payment processes
Large payments, supplier changes and unusual financial requests should always follow an agreed approval process.
7. Monitor for unusual activity
Businesses should be able to detect suspicious logins, unusual downloads, mailbox changes and other warning signs.
8. Create a clear reporting route
Staff should know exactly who to contact if they receive a suspicious request or think they may have made a mistake.
How SOD-IT Can Help Protect Your Business From AI Cybercrime
At SOD-IT, we help businesses strengthen the practical controls that reduce cyber risk.
AI may be changing how attackers operate, but many businesses still need help getting the foundations right.
That includes:
- Email security
- Microsoft 365 protection
- Multi-factor authentication
- Endpoint protection
- Patch management
- Backup and recovery
- User awareness
- Access control
- Monitoring
- Incident response planning
- Cyber Essentials support
- AI governance and secure adoption
Our approach is practical.
We help businesses understand where risk exists, which controls matter most and how to improve security without unnecessary complexity.
The goal is not to scare people.
It is to make businesses better prepared.
AI Is Making Attacks More Convincing. Make Sure Your Business Is Ready.
Cybercriminals are already using AI to improve familiar attacks.
That means businesses need to be more disciplined about the basics.
A well-written email is not proof of legitimacy.
A familiar voice is not enough verification.
An urgent request should not bypass process.
A fast-moving threat landscape requires security controls that are consistent, practical and understood by your team.
If you are concerned about AI cybercrime, get in touch with SOD-IT and we can help you assess your current setup and strengthen the controls that matter most.
📞 0141 488 1533
📧 [email protected]
🌐 www.sod-it.co.uk
