AI-Powered Cyber Threats in the UAE: Which Defences Actually Work?

The defences that work against AI-powered attacks are the ones that do not rely on spotting a fake. AI lets criminals write fluent phishing emails, clone a voice or stage a video call as an executive, and polish fake supplier and payment-change requests. So verify payment and executive requests through a channel you already hold, use phishing-resistant MFA, configure email authentication and impersonation protection, and put approval rules on payments.

What has AI actually changed about attacks on businesses?

Mostly quality and scale rather than new techniques. In January 2024 the UK National Cyber Security Centre (NCSC) assessed that the threat to 2025 comes from the evolution and enhancement of existing techniques, with AI giving attackers capability uplift in social engineering. It noted that generative AI can already produce convincing lures without the translation, spelling and grammatical mistakes that often reveal phishing, and that it will become difficult for everyone, whatever their security knowledge, to judge whether an email or password reset request is genuine.

The FBI makes the same point: generative AI can correct for the human errors that might otherwise serve as warning signs of fraud, and lets criminals reach a wider audience faster with believable content.

This matters because familiar advice leans on those errors. The UAE Cyber Security Council's own list of phishing indicators includes numerous spelling and grammatical errors. The other signs on its list still hold, and they are the ones to train on:

• Requests for advance payments.
• Pressure to take immediate action without reflection.
• Requests for personal data without a clear purpose.
• Deals that are too good to be true.
• Directions to log in through unfamiliar links.

How do deepfake voice and video scams target companies?

The FBI describes criminals using AI-generated audio to impersonate public figures or people close to the victim to get payments, and generating video for real-time video chats with supposed company executives, law enforcement or other authority figures. In a 2025 warning about a campaign that impersonated senior US officials, it described AI-generated voice messages used to build rapport, followed by a link to move the conversation to another messaging platform, and noted that cloned voices can sound nearly identical to the real person.

Closer to home, the UAE Cyber Security Council has warned that fraudsters increasingly combine fake applications with deepfake technology, using fabricated videos or audio recordings to give their schemes false credibility.

For a business, the pattern to plan for is a voice note, call or video from someone who sounds like your managing director or a key supplier, asking for something urgent and unusual, often from a new number or on a new app. Both FBI warnings suggest looking for imperfections such as lag, voice matching and unnatural movement, but both also say AI-generated content can be difficult to identify. Detection by ear is not a control.

How does AI make fake supplier and payment-change requests harder to catch?

Payment-change fraud follows a familiar script: a supplier, or someone posing as one, says its bank details have changed and the next invoice should go to a new account. AI helps with the parts that used to give it away, such as spelling, grammar and translation. Two technical facts explain why a perfect-looking email can still be fake:

• Lookalike domains. Microsoft gives the example of contoso.com being imitated by a domain spelt with accented characters, and notes that such a domain may be registered and have email authentication records configured, so apart from its intent it can look legitimate.
• Real mailboxes that have been taken over. DMARC checks that a message passes SPF or DKIM for a domain that aligns with the From address. A message sent from a supplier's genuine mailbox after an attacker has taken it over goes out through the supplier's own authorised mail system, so it can pass.

Neither problem is solved inside the email. The check has to happen somewhere the attacker does not control.

What verification and approval rules should you set?

Write these down as policy, so that following them is never seen as distrust of a colleague or a supplier:

• Call back on a number you already hold. The FBI's advice is to hang up, research the contact details yourself and call the number directly. Use the number in your supplier file or staff directory, never the one in the message.
• Treat new channels as unverified. If someone you know contacts you from a new number or platform, the FBI advises verifying the new details through a previously confirmed platform or source.
• Two people for payment changes. Any new payee or change of bank details needs a second approver and a recorded call-back before the first payment.
• No exceptions for urgency or seniority. A senior request to skip the process is a reason to run it.
• A code phrase for urgent executive requests. The FBI suggests a secret word or phrase for families to verify each other's identity. The same idea can be applied to a small group of executives and finance staff.
• Never share MFA codes. The FBI warns that attackers use social engineering to get people to disclose two-factor codes.

Which Microsoft 365 controls help?

• Phishing-resistant MFA. In Microsoft Entra, the built-in Phishing-resistant MFA strength allows Windows Hello for Business or a platform credential, a FIDO2 security key, and multifactor certificate-based authentication, methods that require an interaction between the authentication method and the sign-in surface. You require it with a Conditional Access policy, and admins and finance staff are the place to start. Our phishing-resistant MFA page explains the rollout.
• Email authentication. Microsoft describes DMARC as helping prevent spoofed senders used in business email compromise. It recommends a gradual rollout from p=none towards p=reject for all your domains, plus DMARC records on registered domains you never send email from.
• Impersonation protection. Anti-phishing policies in Microsoft Defender for Office 365 can protect named people and domains from impersonation. Microsoft notes that the default policy does not configure those impersonation features, so add your executives, finance staff and key supplier domains yourself.
• Easy reporting. Give staff a one-click way to report a suspicious message, and make sure someone reads the reports.

Our phishing protection service covers both the technical controls and the human side.

What should staff training cover now?

• Verification by process: the call-back, the second approver and the code phrase, practised until they are routine.
• The warning signs that survive AI: urgency, secrecy, a new payee, a new channel, a request to bypass the usual steps.
• What to share in public. The FBI suggests limiting online content of your image or voice, to reduce what fraudsters can use to create fake identities.
• Reporting fast and without blame. The Cyber Security Council stresses prompt reporting of suspicious emails to security teams, noting that swift reporting can prevent major security incidents.
• Finance teams and executive assistants first, since they handle the requests attackers want.

Our security awareness training is role-based, with content for finance, HR, executives and IT, and includes simulated phishing. For the wider email picture, see our guide to seven email attacks and the controls that stop them, and what UAE companies need to know about AI in business.

On the GR Managed IT Core package, Defender alerts are triaged by our Dubai-based SOC in business hours, with P1 incidents covered 24/7. To review your payment controls, MFA and email setup, contact us.