12 Active Cybersecurity Threats Targeting You As You Read This

What Will You Learn?

Reading time is precious when you run a business, so here is the whole article in a handful of lines.

• Singapore is a prime target. Scam and cybercrime victims here lost S$1.1 billion in 2024 (SPF Annual Scams and Cybercrime Brief 2024), and even after a sharp 2025 improvement, losses still reached S$913.1 million, a 17.9% fall from about S$1,112.4 million in 2024 (SPF Annual Scam and Cybercrime Brief 2025).
• The threats are active, not theoretical. Phishing reports jumped 49%, and ransomware rose 21% in 2024, per the Cyber Security Agency of Singapore (CSA).
• Small businesses are squarely in scope. SMEs in professional services such as consulting, legal, and accounting were disproportionately targeted by ransomware crews.
• Most attacks exploit people, not code. Phishing, business email compromise, and AI deepfakes all rely on a human clicking, trusting, or transferring.
• You can defend without a big budget. Multi-factor authentication, patching, backups, and staff awareness stop the overwhelming majority of attacks.
• This guide names all 12 threats, shows how each one shows up in Singapore, and gives you a first line of defence for every single one.

What We Mean By An Active Cybersecurity Threat

An active cybersecurity threat is any method currently being used to steal money, data, or access from organisations like yours. The word that matters is currently.

I’m not listing museum pieces here. Every threat below is documented in Singapore data from 2024 and 2025.

It helps to split threats into three families:

• People-focused: phishing, business email compromise, social engineering, and deepfakes that trick a human into acting.
• Software-focused: ransomware, malware, credential theft, and cloud misconfiguration that exploit systems and settings.
• Structural: supply-chain attacks, insider risk, DDoS, and state-sponsored campaigns that exploit how your business connects to others.

Here’s the part that gives me hope: A small set of habits defends against most of them. The bad news: attackers only need you to slip once.

Singapore Cyber Threat Snapshot

Before the threats themselves, here is the national picture in numbers. Each figure is drawn from official Singapore sources.

Read the trend carefully. Case numbers fell in 2025 because enforcement and public education improved, yet the median loss per victim rose, which means each successful attack hurt more.

Threat 1: Phishing: The Email That Looks Exactly Right

Phishing is a fraudulent message, usually an email, designed to make you click a link, open an attachment, or hand over a password.

It’s the most common entry point for almost every other attack on this list, which is why I start here.

What the local numbers reveal

Phishing reports to CSA surged to 6,100 cases in 2024, a 49% jump from 4,100 the year before.

That is still below the 8,500 cases recorded at the 2022 peak, but the sharp rebound shows the threat is climbing again.

Source: Singapore Cyber Landscape

The most impersonated sector was banking and financial services, followed by government and e-commerce brands that you and your customers already trust.

Attackers now add legitimacy with HTTPS padlocks and common domains like .com, so the old advice to ‘look for the padlock,’ advice I gave for years, no longer holds up.

Why is it getting harder to spot

In a sample of phishing emails reported in 2024, CSA found that 12% contained AI-generated content. This removes the clumsy grammar that used to give scams away. The sample was small, around 60 emails, and the share was slightly lower than in 2023 (13%), so AI-written phishing is best treated as an established tactic rather than a runaway trend.

If you want a grounding in how these tools actually work, our explainer on how AI and machine learning work in plain English is a useful primer for non-technical owners.

Your first line of defence against phishing

• Turn on multi-factor authentication (MFA) everywhere, so a stolen password alone is useless.
• Verify any money or data request through a second channel, such as a phone call to a known number.
• Train every staff member to hover over links and check the real sender address, not the display name.
• Report suspicious messages and use the ScamShield helpline on 1799 when unsure.

Watch Out: The “urgent and from the boss” trap.

Most phishing weaponises authority and urgency together: a message that appears to come from a director, demanding fast action before the close of business.

Make it a standing rule that urgency is a reason to slow down, not speed up. Real leaders will not punish a staff member for verifying.

Threat 2: Business Email Compromise: The Invoice That Quietly Changed

Business email compromise (BEC) is targeted fraud where an attacker impersonates a supplier, executive, or partner to redirect a payment.

The way I explain it: Where mass phishing casts a wide net for small sums, BEC is patient and precise, chasing a single large transfer rather than a thousand small ones.

A Singapore case that shows the scale

In July 2024, a Singapore commodities firm lost S$57.2 million after acting on an email that appeared to come from a known vendor asking it to update bank account details.

The firm only realised it had been scammed when the real vendor sent a late-payment notice. Most of the money was later recovered through cross-border police cooperation, but recovery is never guaranteed.

Why does it work on careful people?

BEC succeeds because the request is plausible and well-timed. Attackers often watch a mailbox for weeks, then strike when a genuine invoice is due.

There’s no malware to detect, which is what makes this one frighten me. The only red flag is a change in payment details, which is easy to miss in a busy finance inbox.

Building a payment process that resists fraud

• Make a callback mandatory for any change of bank account, using a number you already have on file.
• Use a payment approval threshold above which two people must sign off.
• Lock down your email with MFA so attackers cannot read your mailbox in the first place.
• Flag external emails with a banner so staff know when a “colleague” is writing from outside.

Case Example: The cheapest control is a phone call

A 60-second call to a known number would have stopped a multi-million-dollar loss. Build that call into your payment process as a non-negotiable step, not an optional courtesy.

Threat 3: Ransomware: The Morning Your Files Are Held Hostage

Ransomware is malicious software that encrypts your files and demands payment, usually in cryptocurrency, to unlock them.

Increasingly, it is double extortion: criminals steal a copy of your data first, then threaten to leak it if you do not pay.

Who is being hit in Singapore

CSA recorded 159 ransomware cases in 2024, up 21% on the year, with manufacturing, professional services, and ICT the hardest-hit sectors (CSA, p.52-53).

Source: Singapore Cyber Landscape

Critically, for smaller firms, SMEs in professional services such as consulting, legal, and accounting were called out as disproportionately targeted.

The crews behind it included Akira, LockBit, and Phobos, groups that run ransomware as a polished criminal business.

The detail most owners miss

Many infections in Singapore used old malware strains that already had fixes available, but the patches were never applied.

In other words, a large share of the damage was preventable with basic maintenance. I find that genuinely encouraging, because maintenance is one of the few things here you fully control.

Four Ways to Beat Ransomware

• Keep offline, tested backups so you can restore without paying. And I mean tested. A backup you’ve never restored from is a guess, not a plan.
• Patch promptly, especially operating systems, plugins, and remote-access tools.
• Restrict administrator rights so that one compromised account cannot encrypt everything.
• Segment your network so an infection in one area cannot spread freely.

Pro Tip: Do not pay first, plan first

Paying a ransom funds the next attack and offers no guarantee of recovery. Decide your response before an incident: who you call, how you isolate machines, and how you restore from backup.

Singapore co-leads the global Counter Ransomware Initiative, and CSA publishes guidance to help victims make informed decisions rather than panic pay.

Threat 4: Malware and Infostealers: The Quiet Passenger On Your Devices

Malware is any malicious software, and infostealers are a fast-growing variety designed to silently harvest passwords, cookies, and banking details.

Unlike ransomware, infostealers want to stay hidden, which is exactly why I worry about them more.

The scale of infection locally

Infected systems in Singapore rose 67% to 117,300 in 2024, largely driven by botnet drones quietly enrolled into criminal networks (SCL 2024/2025 report, p.54-55).

Many of those machines were running outdated, unpatched software, the same maintenance gap that fuels ransomware.

How does it get in

Common routes include cracked software, fake browser extensions, malicious ads, and booby-trapped attachments.

If your business runs on WordPress, abandoned or pirated plugins are a frequent culprit, which is why our guide to choosing safe WordPress plugins is worth a read before you install anything new.

Keeping infostealers off your devices

• Install software only from official sources, never cracked or “free premium” versions.
• Run reputable endpoint protection on every device, including staff laptops and phones.
• Patch and update automatically wherever possible.
• Use a password manager so a single stolen password does not unlock your whole business.

Key Stat: Old malware, fresh damage

CSA found that many infections used old strains with readily available fixes that simply were not applied. Patching is the single most cost-effective security habit a small business can adopt.

Threat 5: Social Engineering: When The Attacker Simply Asks Nicely

Social engineering is a manipulation that persuades a person to break security rules voluntarily, by phone, message, or in person.

It is the umbrella over phishing, vishing (voice), and smishing (SMS). The target, in my view, is always human judgment, not your firewall.

How the deception plays out here

The SPF reported that in over three in four scam cases, victims transferred money themselves, manipulated by deception rather than by a hacker seizing their account.

Government-official impersonation scams alone rose 60.5% to about S$242.9 million in 2025, a reminder that authority is the scammer’s favourite costume.

The pressure tactics to recognise

• Urgency: “Act now or your account will be frozen.”
• Authority: a caller claiming to be from a bank, ministry, or your own management.
• Secrecy: “Do not tell anyone; this is confidential.”
• Fear: threats of fines, arrest, or losing a contract.

Training judgment, not just systems

• Adopt a “stop, check, act” culture, echoing the SPF’s own public advice.
• Verify identity independently by calling back on an official number you looked up yourself.
• Never share one-time passwords or SingPass credentials with anyone, for any reason.
• Use ScamShield and call 1799 when something feels off.

Singapore Insight: Trust is a business asset worth protecting

Customers judge you on how safely you handle their data and money. The same instincts that protect you internally also protect your brand, a theme we explore in our guide to building trust on your e-commerce website.

Threat 6: Deepfake Executive Fraud: When the Face on the Call is Fake

A deepfake uses AI to fabricate a convincing video or voice of a real person, so a scammer can pose as your CEO, CFO, or a trusted client in real time.

This is the one that genuinely unsettles me: Social engineering with a terrifying upgrade. The usual advice to “get on a video call to confirm” no longer guarantees the truth.

A Singapore case that should worry every finance team

In March 2025, a finance director at a multinational firm in Singapore was tricked into transferring more than S$670,000 (US$499,000) after joining a Zoom call populated entirely by deepfaked executives.

The director only became suspicious when asked to send a further S$1.9 million (US$1.4 million), and alerted the bank, allowing the Anti-Scam Centre to withhold the funds.

For context, a parallel Hong Kong case in early 2024 saw a firm lose US$25 million to the same playbook, as documented by the World Economic Forum.

This is where I think a lot of Singaporeans are quietly overconfident. In CSA’s 2024 Cybersecurity Public Awareness Survey, eight in 10 respondents felt sure they could spot a deepfake, yet only one in four actually could. As then CSA Chief Executive David Koh put it, “we need to be vigilant, and make it harder for them to scam us”.

How to spot a deepfake on a call

• Lip-sync and audio lag that do not quite match the words.
• Stiff expressions and a lack of natural micro-movements.
• Blurring or pixelation around the mouth and eyes.
• Reluctance to do anything spontaneous, such as turning their head or holding up a hand on request.

Verification that survives a convincing face

• Require a second channel to confirm any unusual transfer, such as a call to a known mobile number.
• Set a money rule that survives authority: no transfer proceeds on a video instruction alone, no matter who appears on screen.
• Brief senior leaders that their likeness can be cloned, so they support, rather than resent, verification.
• Limit public video and audio of key executives where practical, since that footage trains the fakes.

Watch Out: Verification must beat hierarchy

Deepfake fraud preys on the fear of questioning a senior leader. If your culture makes a junior staffer afraid to verify the “CEO”, you have already built the attacker’s advantage for them.

Threat 7: Credential Theft and Account Takeover: Your Password is Already For Sale

Credential theft is the harvesting of usernames and passwords, which are then sold or reused to take over accounts, a tactic known as account takeover.

If I had to name the fuel behind everything else on this list, it’s stolen logins. Infostealers, phishing, and old data breaches all feed the same criminal marketplace.

Why small businesses are so exposed

The 117,300 infected systems CSA recorded in 2024 are, in practice, a credential-harvesting machine running quietly in the background (SCL, p.54-55).

When staff reuses one password across email, banking, and your e-commerce admin, a single leak unlocks the entire chain.

Lock Down Your Logins

• Multi-factor authentication is non-negotiable, especially for email, banking, and admin panels.
• Use a password manager so every account has a long, unique password no one has to memorise.
• Kill reuse: one password should never open two doors.
• Review access regularly and remove logins for staff and vendors who have left.

If you manage your own site, harden the login as you build it. Our walkthrough on building a professional WordPress website covers the admin hygiene that keeps account takeover at bay.

Pro Tip: MFA is the highest-return hour you will spend

Most account takeovers collapse the moment a second factor is required. If you do only one thing after reading this article, switch on MFA across your critical accounts today.

Threat 8: Supply Chain Attacks: Breached Through Someone You Trust

A supply chain attack compromises you indirectly, through a software vendor, IT provider, or partner that already has access to your systems or data.

Here’s the uncomfortable truth I keep repeating to clients: You can secure your own house perfectly and still be breached through a contractor’s key.

Why Singapore’s connectivity raises the stakes

CSA’s threat typology explicitly lists supply chain attacks among the categories affecting organisations across Singapore’s ICT sector.

The fragility is structural, too. Singapore connects to 26 submarine cables, and three major cloud outages in 2024 (Alibaba, Microsoft Azure, and Salesforce) showed how a single dependency can disrupt many businesses at once (SCL, p.24-25).

Managing the risk you inherit from partners

• Vet your vendors: ask how they secure your data before you sign, not after an incident.
• Limit third-party access to only what each provider genuinely needs.
• Keep an inventory of every tool, plugin, and service that touches your data.
• Plan for outages with backups and a fallback so one provider’s bad day is not your disaster.

Singapore Insight: Your tools are part of your attack surface

Every app you connect, from a marketing automation tool to a delivery plugin, extends your exposure. When you evaluate new software, including the AI tools many e-commerce owners now adopt, weigh the security questions alongside the features.

Threat 9: Insider Threats: The Risk That Already Has a Badge

An insider threat comes from someone with legitimate access: a current or former employee, contractor, or partner, whether malicious or simply careless.

Insiders skip your perimeter defences entirely, because they are already inside.

Two flavours, both dangerous

• Malicious insiders steal data or sabotage systems, often on the way out the door.
• Accidental insiders cause harm through mistakes: a misdirected email, a lost laptop, or a careless click.

A modern twist Singapore firms should note

In one July 2024 case, a company unknowingly took on a North Korean operative posing as a software engineer, who had used an AI-generated headshot and a fabricated identity to clear the hiring checks, and malware surfaced the moment he was issued a work laptop (MAS information paper).

To me, that case rewrote the rulebook. The insider threat now includes fraudulent hires, which makes identity verification a security control, not just an HR formality.

Limiting what any one person can do

• Apply least privilege: give each person access only to what their role requires.
• Offboard immediately by revoking accounts the moment someone leaves.
• Log and review access to sensitive data so unusual activity stands out.
• Verify identities at hiring, especially for remote technical roles.

Building this capability internally pays off. If you are weighing whether to upskill staff or recruit specialists, our perspective on whether a cybersecurity degree is worth it in Singapore offers a candid view.

Threat 10: Cloud Misconfiguration: The Data You Left in the Open

Cloud misconfiguration is the accidental exposure of data or systems through wrong settings, such as a storage bucket left public or a default password unchanged.

No one breaks in, and that’s what makes this one so avoidable, in my opinion. The door was simply left open, often by a busy team moving fast.

Why is it so common

As CSA notes, the shift to cloud introduces new risks, and the agency is developing a Cybersecurity Code of Practice for Cloud to guide safer adoption (SCL, Chapter 1).

Cloud security runs on a shared responsibility model: the provider secures the platform, but you are responsible for your own settings, access, and data.

Locking down your cloud settings

• Default to private: storage and databases should never be public unless there is a deliberate reason.
• Change every default credential before a system goes live.
• Turn on logging and alerts so exposed resources are flagged quickly.
• Review permissions periodically, because access tends to sprawl over time.

Key Stat: Three big clouds, one shared lesson

The 2024 outages at Alibaba, Microsoft Azure, and Salesforce reminded every business that convenience and concentration carry risk. Know which providers you depend on, and what happens to your business if one fails.

Threat 11: Distributed Denial of Service: Your Website is Flooded Off the Internet

A distributed denial-of-service (DDoS) attack floods your website or service with junk traffic from thousands of machines until it slows to a crawl or goes offline.

For an online business, I treat downtime as two problems at once: Lost revenue, and sometimes a smokescreen for a second attack.

Singapore’s place on the attack map

In the fourth quarter of 2024, Singapore ranked seventh worldwide among the most-targeted countries and was the third-biggest origin of DDoS traffic, a reflection of how many local devices had been quietly conscripted into botnets (SCL, p. 26-27).

Those same botnet drones behind the 117,300 infected systems are the foot soldiers of a DDoS attack.

Keep your site online

• Use a reputable hosting or CDN provider with built-in DDoS protection.
• Put your site behind a web application firewall that can absorb and filter malicious traffic.
• Have an incident plan, so staff know who to contact when the site goes down.
• Keep devices patched so your own hardware is not part of someone else’s attack.

Case Example: Uptime is a customer-trust issue

A shop that is offline during a sale loses both sales and confidence. Treat resilient hosting as a revenue protection measure, not just an IT line item.

Threat 12: Advanced Persistent Threats: The Patient, Well-funded Attacker

An advanced persistent threat (APT) is a sophisticated, often state-sponsored, group that breaks in quietly and stays for months to spy or sabotage.

You might assume APTs only chase governments. I did too, once. In reality, smaller firms are valued as stepping stones into larger, better-defended targets.

The groups watching Singapore

CSA’s 2024/2025 landscape highlights UNC3886, a group targeting high-value, strategic Singapore targets, including critical infrastructure.

APT activity is rising in scale and sophistication, and increasingly focuses on network edge devices such as routers, smart cameras, and sensors that businesses rarely patch.

Defending against a patient adversary

• Patch edge devices such as routers, firewalls, and IoT gear, not just laptops.
• Monitor for unusual access at odd hours or from unexpected locations.
• Segment critical systems so that a foothold in one area does not expose everything.
• Know your role in the chain: if you supply a larger organisation, you may be the way in, and they will expect you to be secure.

Watch Out: Being small is not being invisible

Sophisticated attackers often start with the least-defended link. If your business connects to a bank, a government body, or a large enterprise, your security is part of theirs, and theirs is part of yours.

The 12 Threats at a Glance

Here is the whole list in one view, so you can see which threats target which part of your business and what to do first.

Pin this table somewhere visible. It turns an abstract worry into a concrete checklist.

Building a Practical Defence on a Small-business Budget

In my experience, you don’t need an enterprise security team to be safe. You need a small set of controls applied consistently.

Notice the pattern across all 12 threats: a handful of habits keep appearing. That overlap, I’d argue, is your biggest shortcut.

The control quick reference

This table maps each core control to what it stops and the rough effort or cost in Singapore dollars. Most of the highest-impact controls are free or low-cost.

Costs are indicative and vary by provider. The point is the ratio: a small, steady investment defends against threats that can cost six or seven figures.

Pro Tip: Start with the free wins this week

If the list feels long, do this in order: turn on MFA, set up automatic updates, and start one reliable backup. Those three cost nothing and remove a huge slice of your risk.

Where Singapore Businesses Can Get Help

The thing I most want you to take away here: You’re not on your own. Singapore has built unusually strong, accessible support for smaller organisations.

Government and national resources

• CSA’s SG Cyber Safe programme offers the Cyber Essentials and Cyber Trust marks, designed to give SMEs a clear, prioritised baseline.

Source: CSA’s SG Cyber Safe programme

• ScamShield and the 1799 helpline let you and your staff check anything suspicious in real time.

Source: ScamShield

• The SPF Anti-Scam Command can act fast on fraudulent transfers, as the deepfake and BEC recoveries above show.

Funding to offset the cost

Cost should not be the barrier it once was. Eligible businesses can tap the Productivity Solutions Grant (PSG) from Enterprise Singapore to support the adoption of pre-approved digital and security solutions, as covered in our guide to the PSG grant and eligible tools.

Building the skills in-house

The most durable defence is a team that recognises threats instinctively. If you are mapping out a security career path for yourself or a hire, our overview of cybersecurity internships in Singapore shows how local talent is being grown.

Source: Equinet Academy

Singapore Insight: Awareness is the control that scales

Tools help, but trained people are what stop a deepfake call or a fake invoice in the moment. Investing in awareness multiplies the value of every other control you buy.

Conclusion

The twelve threats in this guide are not distant possibilities. They are the working methods of criminals and state actors operating in Singapore right now.

Yet I don’t think the picture is anywhere near hopeless. Read back through the defences, and a clear pattern emerges.

A handful of steady habits protects against almost all of them: multi-factor authentication, prompt patching, tested backups, and a culture where staff feel safe to verify before they act.

Those four habits will, I’m convinced, carry you further than any single expensive tool.

The data even offers encouragement. Singapore’s falling 2025 figures show that awareness and enforcement work, proof that informed people change outcomes.

The gap that remains is rarely technology. It is the moment a busy person clicks, trusts, or transfers without pausing.

And that gap, I firmly believe, is closed by knowledge, not gadgets.

The country’s own cyber chief has made the point plainly. Reflecting on a decade of escalating threats, then CSA Chief Executive David Koh warned that “AI-powered deepfakes and scams trick companies and individuals of large sums of hard-earned monies”, and urged businesses and individuals to redouble their defences.

If this article gave you a clearer map of the threats, the natural next step is to turn that awareness into a repeatable skill for you and your team. That is exactly what Equinet Academy’s Cybersecurity Awareness & Essentials for Workplace Employees & Business Owners course is built to do.

It teaches non-technical owners and staff to spot these exact threats, weigh their business impact, and put practical, prioritised safeguards in place.

For any Singapore business owner who wants to stop reacting and start protecting, it is the logical move from reading about risk to managing it.