Hackers Are Automating Their Work. Is Your Business Could on Their To-Do List?

Click here to view/listen to our blogcast.

Business owners are looking for ways to use artificial intelligence to get more done with fewer resources. Criminals are doing the same thing.

An October 19 Reuters investigation describes an attacker who directed AI agents against more than 1,200 websites, with reported break-ins involving over 100 companies. A researcher estimated the campaign consumed roughly $5,000 in AI usage.

The unsettling part is how little ongoing human involvement the attacks required. The attacker provided instructions, and the agents spent hours investigating targets and attempting to break in. Reuters could not determine the extent of data theft, but the activity illustrates a significant change in how criminals can operate.

From Answering Questions to Carrying Out Attacks

A chatbot responds to a question. An AI agent can be equipped with tools and given a goal, then take actions toward completing it. In legitimate business use, that might mean researching suppliers or handling routine requests. In criminal hands, it can mean examining a website, identifying weaknesses, testing possible entry points, and deciding what to try next.

Automated attacks have existed for years. The important development is the ability to adjust as new information becomes available. NorForge’s original investigation describes agents recording discoveries and using them to guide subsequent actions. Researchers also independently checked some reported compromises.

Think of the difference between repeatedly checking the same locked door and investigating a building for another way inside. AI agents can help criminals perform more of that investigative work without personally directing every step.

For smaller organizations, our concern is straightforward: sustained attention is becoming cheaper. Being a small practice, nonprofit, or local business offers little comfort when an attacker can delegate the work.

How Stolen Access Becomes Money

A stolen login has value even when the thief never uses it personally.

Microsoft’s investigation of credential-stealing malware explains how stolen access moves through a criminal marketplace. Some criminals collect credentials, others check whether they work, and buyers use them for fraud, ransomware, or further intrusions. The person who opens the door may simply sell the key.

AI can also help criminals recognize what is valuable after they get inside.

In September, Microsoft announced the disruption of EvilTokens, an AI-enabled criminal service. Its tools could analyze compromised inboxes, identify financial conversations and people responsible for payments, and suggest opportunities for impersonation.

Picture an attacker finding a real invoice conversation, learning who approves payments, and preparing a convincing request to change the vendor’s bank details. That is a business fraud problem, with AI helping the criminal understand your organization.

Your Technology Can Become Their Resource

Criminals may also want the services you pay for. The recent OpenCode breach exposed stored credentials used to access outside AI providers. Users reported unauthorized charges. The plain-English consequence: someone else could use paid AI services through compromised access while costs appeared on the victim’s account.

Separately, Sysdig researchers observed an attacker using an exposed AI server to power an automated hacking tool. That case involved an improperly protected server rather than stolen login credentials, but it illustrates another risk: your computing resources can become part of someone else’s attack operation.

These are separate incidents. Together, they show why protecting information is only part of the job. Access, subscriptions, and computing capacity also have value.

What You Can Do

The fundamentals still matter, but they need consistent attention:

• Maintain what faces the Internet. Websites, remote access systems, and management tools need timely updates. Retire abandoned services.
• Protect accounts and limit access. Use multifactor authentication and give employees and applications only the permissions they need.
• Control AI connections. Know which tools employees use, which business accounts they connect, and who reviews those connections.
• Watch activity and spending. Investigate unusual sign-ins, unexpected service usage, and unexplained charges. Configure spending controls where available.
• Verify payment changes independently. Call a known contact using a trusted number before redirecting money, even when the email conversation looks authentic.

How CDML Can Help

CDML helps organizations connect these protections through managed IT, cybersecurity, Microsoft 365 security, and practical technology guidance.

That includes reviewing exposed systems, maintaining supported software, strengthening account protections, and helping management establish sensible rules for AI use. Employees also need clear procedures for reporting suspicious activity and verifying financial requests.

The goal is to reduce opportunities for intrusion and make unusual activity easier to recognize and investigate.

Final Thoughts

Criminals are applying AI to the entire business of cybercrime: finding targets, gaining access, identifying opportunities, and pursuing profit. Your organization does not need to be famous to have something worth stealing. A working account, a trusted email relationship, or access to a paid service may be enough.

If you are unsure where those opportunities exist in your environment, contact CDML Computer Services. We can help you identify the gaps and prioritize practical improvements.

Stay safe. Stay informed. Stay compliant.

📞 Contact us here: https://cdml.com/contact/
📚 Read more on our blog: https://cdml.com/blog-2
📺 Listen to our blogcasts: https://www.youtube.com/@CDMLComputerServices