Help customers prepare for an appointment: a website checklist
October 21, 2026
How to write useful alt text for your website images
October 22, 2026Happy Halloween from Host Hobbit! We’re getting into the spooky spirit early. This year, the things lurking at your digital door might arrive wearing the mask of a helpful AI tool.
For our Halloween tech-news special, here are two real security stories with a suitably chilling lesson for small businesses. The ghosts are imaginary. The need to check what you trust is real.
1. The familiar face with something sinister underneath
A message arrives: your AI subscription needs a payment update. The name looks familiar. The request sounds urgent. Cue the horror-film music.
In a 10 September 2026 security report, Microsoft described campaigns impersonating popular AI services. Examples included payment phishing, fake installers and malicious advertising. Microsoft said one ChatGPT-themed campaign sent up to 100,000 emails in a day.
These were criminals borrowing familiar brands, not evidence that the named AI services had been compromised. Think of it as a convincing Halloween costume with a thief inside.
Keep the monster outside: if a message asks you to pay or sign in, open the service through your usual saved address or app. Check the request there. Get software through the provider’s official channels, and give urgent download prompts a second look.
2. The helper you gave the keys to the haunted house
What if the unnerving character is already inside, carrying the keys you handed over?
In its 19 October 2026 article on AI agents, Microsoft argued that businesses need stronger controls over the agents they deploy. Its concern: agents can have broad access to data and tools, and can take actions that do not match what the organisation intended.
That does not make every assistant a rogue machine. It does make permissions worth checking before a useful experiment becomes a very expensive jump scare.
Keep a hand on the keys: our practical takeaway is to give an AI tool only the access needed for its job. Check which files and accounts it can reach. Keep a person in charge of approving sensitive changes, and know how to remove the tool’s access.
A small-business trick-or-treat check
- Check unexpected payment requests through a separate, trusted route.
- Review the tools connected to your website and business accounts.
- Remove access that is no longer needed.
- Make sure your team knows who to tell if something feels wrong.
Microsoft’s phishing guidance has more help with suspicious messages.
Have a wonderfully spooky Halloween season from all of us at Host Hobbit. May your pumpkins glow, your treats be plentiful and your business avoid unwanted digital visitors.
Something on your website giving you the creeps? Get in touch and tell us what you need help with.
News checked on 21 October 2026. Halloween imagery is used for illustration.