• Microsoft has highlighted two major ways in which AI is being used by cybercriminals.
• The tool turns previously complex tasks like mimicking an ecommerce website into child’s play.
• Internet denizens are urged to exercise increased caution when offered deals too good to be true or employment opportunities that are really a way to steal information.

As a champion of artificial intelligence, Microsoft has a duty to not only develop solutions, but also understand how its technology can be used for evil. While AI may offer benefits for businesses, it can also be leveraged by cybercriminals to execute all manner of attacks and inspire new ones.

As Microsoft tells it in its latest Cyber Signals blog, AI has lowered the bar for entry into cybercrime. Where once you needed specialised tools and at least a surface-level knowledge of how the web and databases work, you can now just ask an AI to help you spin up a website that looks identical to Amazon or some other major brand.

So how exactly are cybercriminals using AI?

As mentioned above, one of the ways is by impersonating ecommerce websites. Cybercriminals can spin these up in a few minutes with the help of AI. Fraudsters can either create something new or emulate an existing brand in order to con more users into engaging with the fake website.

According to Microsoft, some cybercriminals will go so far as to set up AI chatbots in order to appear more legitimate These bots can also assist in distracting the customer and cause them to miss the deadline on chargebacks and the like. Some criminals will even go so far as to use AI to generate fake customer reviews, descriptions and images in order to lure folks into the trap.

This is bound to become a more popular attack vector given the increase in tariffs in the US where desperate buyers could visit fraudulent websites in hopes of getting a good deal.

Cybercriminals are also targeting job-seekers. Using AI, ne’er-do-wells will create fake job listings, and conduct interviews using AI and automated emails in order to garner personal information and even money from job-seekers.

“Fraudsters often ask for personal information, such as resumes or even bank account details, under the guise of verifying the applicant’s information. Unsolicited text and email messages offering employment opportunities that promise high pay for minimal qualifications are typically an indicator of fraud,” warns Microsoft.

“Employment offers that include requests for payment, offers that seem too good to be true, unsolicited offers or interview requests over text message, and a lack of formal communication platforms can all be indicators of fraud,” the company adds.

The company says that cybercriminals often prey on the emotions of a target in order to convince them to click a link they shouldn’t or share their information with a stranger.

As such, Microsoft recommends consumers be cautious of:

• Impulse buying – Scammers create a sense of urgency with “limited-time” deals and countdown timers.
• Trusting fake social proof – AI generates fake reviews, influencer endorsements, and testimonials to appear legitimate.
• Clicking on ads without verification – Many scam sites spread through AI-optimized social media ads. Consumers should cross-check domain names and reviews before purchasing.
• Ignoring payment security – Avoid direct bank transfers or cryptocurrency payments, which lack fraud protections.

As far as job scams though, these can be tough to weed out and cybercriminals know this. If you are a job seeker, keep the following in mind:

• Verify employer legitimacy – Cross-check company details on LinkedIn, Glassdoor, and official websites to verify legitimacy. If a company doesn’t have an online presence at all, be cautious.
• Notice common job scam red flags – If a job requires upfront payments for training materials, certifications, or background checks, it is likely a scam. Unrealistic salaries or no-experience-required remote positions should be approached with skepticism. Emails from free domains (such as johndoehr@gmail.com instead of hr@company.com) are also typically indicators of fraudulent activity.
• Be cautious of AI-generated interviews and communications – If a video interview seems unnatural, with lip-syncing delays, robotic speech, or odd facial expressions, it could be deepfake technology at work. Job seekers should always verify recruiter credentials through the company’s official website before engaging in any further discussions.
• Avoid sharing personal or financial information – Under no circumstances should you provide a Social Security number, banking details, or passwords to an unverified employer.

As AI becomes more powerful, scammers, fraudsters and other cybercriminals are likely to lean on these tools just as much, if not more, than businesses will. We’re all going to have to take cybersecurity a little more seriously especially as AI becomes more advanced.