For most Australian businesses, generative AI has been a productivity story: quicker drafting, faster research, cleaner code. But the same technology is now being packaged and sold to criminals, and it is already reshaping the threat landscape your team must navigate every day.
Research teams have been tracking the emergence of purpose-built malicious large language models tools like WormGPT 4 and KawaiiGPT. Unlike mainstream AI assistants, these models have had their ethical guardrails deliberately removed. WormGPT 4 is openly advertised on Telegram and underground forums from around US$50 per month, and it will readily produce working ransomware scripts, convincing phishing emails, and business email compromise (BEC) lures on request.
The concerning part isn’t the sophistication; it is the accessibility. A scammer who previously lacked the English skills or coding ability to mount a convincing attack can now buy a subscription and generate a polished payload hack, or a flawless fake invoice email, in seconds.
The Australian Signals Directorate’s Annual Cyber Threat Report 2024–25 confirms the pressure is translating into local outcomes. The ACSC responded to more than 1,200 cyber security incidents (an 11% increase year-on-year), notified entities of potential cyber activity over 1,700 times, and received more than 84,000 cybercrime reports - roughly one every six minutes. The average loss per cybercrime reported by a business was $80,850, rising to more than $200,000 for large organisations.
AI-driven scams, data theft, and ransomware are all called out as headline threats. Email and identity-based attacks, the ones your staff see in their inbox every day, remain the most common way in.
Endpoint protection, MFA, and filtering are essential, but they do not meet the attacker at the place they are most often succeeding: the human click. When a phishing email is now grammatically perfect, personalised, and timed to a real event, the last line of defence is an employee who recognises the pattern and pauses.
That is a skill. And like any skill, it fades without practice.
This is exactly why we built the CyberHeroes program here at IT Basecamp. As part of this program we offer the fundamentals course, which is designed for every staff member, not just IT, so the whole business works from the same baseline: recognising phishing, handling credentials safely, reporting suspicious activity quickly, and understanding why the “small” mistakes matter.
Just as importantly, CyberHeroes is built around repetition. Short, regular training keeps cyber awareness front of mind, so that when a well-crafted AI-generated lure lands in someone’s inbox, the response is reflexive rather than reliant on memory of a training session from two years ago.
Your next step
If your team is already enrolled in CyberHeroes, now is a good moment to confirm everyone is up to date on the fundamental’s module and that any new starters have been onboarded.
If you are not yet part of the CyberHeroes program, please get in touch with IT Basecamp. We will walk you through what is covered, how it is delivered, and how quickly we can have your whole team baselined. In a threat environment where the attackers have AI on their side, an untrained workforce is a risk you no longer need to carry.
Contact IT Basecamp
Web: itbasecamp.com.au
Cyber services: itbasecamp.com.au/services/cybercrime