AI has made data theft and extortion attacks faster, cheaper, and accessible to operators who previously lacked the skills to conduct them. Small businesses are now viable targets. The complete attack lifecycle — from credential theft to pay-or-leak demand.
Read advisory →Organised criminal groups are systematically stealing AI API keys from small businesses — then using those credentials to run attack operations at the victim's expense. One group downloaded 1.8 million apps specifically to scan for exposed keys.
Read advisory →A documented criminal operation offered "cheap Claude access" that was actually credential theft dressed up as a service. Customers got responses from a different model while their credentials were stolen and sold onward.
Read advisory →Criminals are targeting the AI tools and integration services your business relies on — not to attack you directly, but to steal the API keys those services hold on your behalf. A breach of one AI vendor can expose the credentials of all their customers.
Read advisory →A documented hacktivist ran a month-long campaign attacking political parties and media organisations using stolen API keys from businesses that had nothing to do with the targets. Your account becomes the platform — creating risks of suspension and legal exposure.
Read advisory →A state-linked operation compromised hotel WiFi management vendors, hijacked DNS records across multiple hotels, and delivered malware to guests through convincing fake update prompts. Anyone who connected was exposed — including to your business email and financial accounts.
Read advisory →