Cybersecurity threats continue to rise across the UK, with small and medium-sized businesses increasingly targeted by ransomware, phishing, and AI-driven attacks. As cybercriminals continue to adopt new technologies and redefine their approaches, businesses can no longer rely on traditional security measures alone.
In this July cybersecurity roundup, we explore the biggest threats affecting businesses right now and what organisations can do to strengthen their security posture today.
AI-powered phishing attacks continue to rise
It’s no surprise hackers are using AI to power their attacks, but the way they do so continues to evolve. Hackers can now use AI to power highly convincing phishing campaigns, which is exactly what happened to an unfortunate group of Microsoft Teams users.
A recent report by Check Point’s email researchers shared that attackers are abusing Microsoft login pages to trick users into handing over confidential information.
The message looks like a Microsoft Planner task notification titled ‘Payroll, Compensation + Benefits Update’. It was designed for users to click through quickly. When users click, the link opens a legitimate login URL and signing in redirects to the attacker’s link. After users click through, the link opens a legitimate login.microsoftonline.com URL, not a look-alike domain – making it look completely unsuspicious. When users sign in, they are prompted to click “approve permissions” or “accept on behalf of your organisation”, thus redirecting the browser to the original request, which is the attacker’s own link, not Microsoft’s.
Why this matters for your business
Phishing attacks are becoming more sophisticated. This attack bypassed people by providing a legitimate link and then backtracking to a suspicious link. This incident shows that basic security measures are no longer enough; user awareness is imperative, as no matter how secure your system is, it can simply take one clicked link to give it all away.
Sheffield businesses are adopting AI faster – but security policies are lagging
AI is quickly becoming a key part of business operations, with organisations across Sheffield adopting it in unique ways. It can automate tasks and support decision-making, but legislation is considered to fall behind the rapid speed of AI development. This is because breakthroughs in AI capabilities and models routinely outpace the multi-year legislative cycles required to pass laws.
Why this matters for your business
With little AI regulation, it falls on individual businesses to take responsibility for how AI is used. A lack of regulation quickly creates gaps that cybercriminals can exploit. This can be anything from specific data leaks to, more generally, a larger attack surface.
On top of this, without proper AI regulation, employees may enter confidential information into public prompt boxes that can be saved for model training.
Cyber security bill debated in the House of Lords
The Cyber Security and Resilience (Network and Information Systems) Bill is now being debated in the House of Lords. This bill aims to strengthen the cybersecurity of organisations in the UK that provide essential services, such as energy and healthcare. This bill would amend the Network and Information Systems (NIS) Regulations 2018 to include additional sectors and update incident reporting duties.
Why this matters for your business
Even if your business is not classified as providing an “essential service”, the impact of this bill will likely extend across supply chains. Larger organisations dealing with stricter regulations will expect the same from their suppliers and partners.
Getting ahead now by reviewing your cybersecurity measures and ensuring compliance with existing standards will position your business as a trusted partner, rather than a potential risk.
OpenAI test models escaped test environments and hacked a start-up
During an internal cybersecurity test, two advanced OpenAI models escaped a controlled test environment, hacking into Hugging Face, one of the world’s largest hubs for sharing AI models, and gaining access to some internal company systems.
This was entirely unprecedented, occurring after the models were tested to assess their hacking capabilities in a sandbox (sealed-off test environment so restrictions could be turned off). OpenAI said these AI agents broke out of the sandbox using a previously unknown security flaw and worked their way across OpenAI’s internal system until they managed to gain internet access.
The AI agent found its way to Hugging Face as it could not answer the prompted security questions and discovered that it would likely have the answers it needed.
Why this matters for your business
This matters for businesses like yours as it reinforces that even in controlled environments, AI can be unpredictable and dangerous. It reinforces the need for strict AI regulation for businesses in and around South Yorkshire, and awareness training for staff across companies. With the right safeguards in place, AI can be extremely helpful to organisations. However, it needs to be treated as the powerful technology it is.
Evolving cyber threats
As cyber threats continue evolving, UK businesses – especially SME’s – need to be proactive with their own cybersecurity. From tightening AI usage policies to preparing for upcoming regulations like the Cyber Security and Resilience Bill, staying ahead is no longer optional.
Concerned about how these dangers could impact your business? Book a free cybersecurity consultation with our team. We’ll assess your current setup, identify vulnerabilities, and provide practical recommendations.
