Major Cybersecurity Threats and Attacks in Africa

1. Introduction

Africa is undergoing rapid digital transformation. Internet access, mobile banking, fintech, e-commerce, cloud services, digital government platforms, and mobile communication have become increasingly important to individuals, businesses, and governments.

However, this digital growth has also created a larger attack surface for cybercriminals. Cyberattacks can result in financial losses, theft of personal information, disruption of essential services, reputational damage, and threats to national security.

According to INTERPOL's 2025 Africa Cyberthreat Assessment Report, cyber-related offences account for a significant proportion of reported crime in parts of Africa, reaching more than 30% of reported crime in Western and Eastern Africa. The report identifies online scams, ransomware, business email compromise and digital sextortion as major threats.

The problem is therefore not simply a technical issue. Cybersecurity affects economies, governments, businesses, individuals and national security.

2. Major Cybersecurity Threats in Africa

2.1 Phishing and Online Scams

Phishing is one of the most common cyberattacks in Africa.

Attackers pretend to be trustworthy people or organizations in order to trick victims into providing information such as:

• usernames
• passwords
• bank details
• ATM/PIN information
• OTP codes
• cryptocurrency credentials
• personal information

Phishing can occur through:

• email
• SMS
• WhatsApp
• social media
• fake websites
• phone calls
• messaging applications

INTERPOL reported in 2025 that online scams, particularly phishing, were the most frequently reported cybercrime in Africa.

Example

A victim may receive a message claiming:

"Your bank account has been suspended. Click here to verify your account."

The link leads to a fake banking website. When the victim enters their login information, the attacker receives the credentials.

Why it is dangerous

Phishing is particularly effective because it attacks the human element, rather than necessarily requiring sophisticated technical exploitation.

3. Ransomware

Ransomware is malware that prevents victims from accessing their files or systems, usually by encrypting them. Attackers then demand payment for restoring access.

Modern ransomware frequently uses double extortion:

1. The attackers steal the victim's data.
2. They encrypt the victim's systems.
3. They demand payment.
4. They threaten to publish the stolen information if the victim refuses.

INTERPOL's 2025 assessment identifies ransomware as one of Africa's major cyberthreats. It reported ransomware detections in 2024 of 17,849 in South Africa, 12,281 in Egypt, 3,459 in Nigeria and 3,030 in Kenya, based on Trend Micro data cited by INTERPOL.

Common targets

• hospitals
• banks
• universities
• government agencies
• telecommunications companies
• manufacturing companies
• small and medium-sized businesses

Impact

Ransomware can cause:

• loss of access to files
• interruption of business
• financial losses
• data leaks
• loss of customer confidence
• expensive recovery operations

4. Business Email Compromise (BEC)

Business Email Compromise occurs when criminals compromise or impersonate a legitimate business email account in order to deceive employees into transferring money or revealing sensitive information.

For example, an attacker may compromise an executive's email account and send:

"Please transfer ₦20 million to this account immediately. It is for an urgent business transaction."

Because the email appears to come from a legitimate executive, an employee may authorize the transfer.

INTERPOL reports that BEC is a significant threat in Africa and that highly organized criminal groups in West Africa have used BEC schemes to conduct multi-million-dollar fraud.

Why BEC is dangerous

Unlike some attacks that require sophisticated malware, BEC often relies heavily on:

• social engineering
• stolen credentials
• impersonation
• compromised email accounts
• psychological manipulation

5. Digital Sextortion

Digital sextortion involves threatening someone with the release of intimate images, videos or other sensitive material unless the victim provides money or complies with the attacker's demands.

Attackers may:

• obtain images through deception
• compromise social media accounts
• create fake relationships
• manipulate victims into sending material
• use AI-generated images or other manipulated content

INTERPOL reported that 60% of African member countries surveyed reported an increase in digital sextortion reports.

This threat is particularly serious because the damage can extend beyond financial loss to include psychological, social and reputational consequences.

6. Identity Theft

Identity theft occurs when attackers obtain and misuse someone's personal information.

Stolen information can include:

• names
• national identification information
• passwords
• bank information
• phone numbers
• email addresses
• biometric information

Attackers may use stolen identities to:

• open fraudulent accounts
• conduct financial fraud
• impersonate victims
• bypass security systems
• commit other crimes

Identity theft becomes increasingly important as African countries expand digital identity systems and online government services.

7. Data Breaches

A data breach occurs when unauthorized individuals gain access to confidential information.

Organizations can hold enormous amounts of sensitive information, including:

• customer records
• employee information
• financial records
• medical information
• passwords
• government information

A successful breach can expose thousands or millions of records.

The consequences include:

Organization → compromised database → stolen information → financial/reputational damage → affected individuals

Data breaches can occur because of:

• weak passwords
• unpatched software
• stolen credentials
• misconfigured servers
• malicious insiders
• phishing
• vulnerabilities in web applications

8. Distributed Denial-of-Service (DDoS) Attacks

A DDoS attack attempts to make a website or online service unavailable by overwhelming it with huge amounts of traffic.

For example:

Attacker → thousands of compromised devices → enormous traffic → target website/server → service becomes unavailable

DDoS attacks can target:

• government websites
• banks
• universities
• telecommunications companies
• news organizations
• businesses

INTERPOL's 2025 report notes that DDoS attacks remain a significant concern in Africa. It cites 4,753 DDoS incidents recorded in Ghana during the first half of 2024, with peak attacks reaching 314 Gbps.

9. Malware and Banking Trojans

Malware means malicious software designed to damage systems, steal information or provide unauthorized access.

Examples include:

• Trojans
• spyware
• keyloggers
• information stealers
• botnets
• banking malware

Banking Trojans are particularly dangerous because they can target financial information.

A keylogger, for example, can record what a victim types, potentially capturing usernames, passwords and other sensitive information.

INTERPOL's Africa assessment continues to identify banking Trojans and information stealers among the cybercrime threats affecting the continent.

10. Mobile Money and Financial Fraud

Africa's extensive use of mobile financial services creates an important cybersecurity challenge.

Attackers may target:

• mobile money accounts
• banking applications
• SIM cards
• mobile banking credentials
• payment platforms

Techniques can include:

• phishing
• SIM-related fraud
• social engineering
• stolen OTPs
• fake mobile applications
• account takeover

The increasing digitization of financial services means that cybersecurity is becoming increasingly important to Africa's financial sector.

11. Attacks Against Critical Infrastructure

Cybercriminals and other threat actors can target infrastructure that society depends upon.

Examples include:

• electricity
• telecommunications
• water systems
• transportation
• healthcare
• financial systems
• government services

An attack against critical infrastructure can have consequences beyond the organization itself.

For example:

Cyberattack → electricity system disrupted → businesses affected → hospitals affected → economic disruption

INTERPOL specifically highlights attacks against critical infrastructure as part of Africa's changing cyberthreat landscape.

12. Social Engineering

Social engineering is the psychological manipulation of people into performing an action that benefits an attacker.

Instead of attacking a computer directly, the attacker attacks the person using the computer.

Examples include:

• pretending to be a bank employee
• pretending to be a manager
• fake technical-support calls
• romance scams
• investment scams
• fake job offers
• fake government messages

This is important because even an organization with strong technical security can be compromised if an employee is successfully manipulated.

13. Why Africa Is Particularly Vulnerable

It would be incorrect to say that Africa is simply "bad at cybersecurity." In fact, the continent has made significant progress.

The ITU Global Cybersecurity Index 2024 says Africa was the region that improved the most in cybersecurity commitment between 2021 and 2024. Africa's average GCI score increased by 22 points to 57.

Nevertheless, several challenges remain.

Major challenges include:

1. Shortage of cybersecurity professionals

There is a need for more trained cybersecurity specialists, incident responders and digital-forensics professionals.

2. Limited resources

Some organizations cannot afford advanced security tools, monitoring systems and professional security teams.

3. Rapid digitalization

Technology adoption can sometimes happen faster than security controls are implemented.

4. Lack of cybersecurity awareness

Users may still fall for phishing, scams and social-engineering attacks.

5. Uneven cybersecurity maturity

Cybersecurity capabilities vary significantly between African countries.

The ITU's 2024 assessment places African countries across all five cybersecurity maturity tiers, from "Building" to "Role-modelling." Ghana, Kenya, Mauritius, Rwanda and Tanzania were classified as role-modelling countries in the African regional assessment. Nigeria was classified as "Establishing."

6. Cross-border nature of cybercrime

An attacker may be physically located in one country, use infrastructure in another country, target victims in several countries and move stolen money through yet another jurisdiction.

That makes international cooperation essential.

14. Real-World African Cybercrime Example

One of the clearest demonstrations of the scale of the problem is INTERPOL's Operation Serengeti 2.0, conducted in 2025.

The operation involved 18 African countries and the United Kingdom and targeted ransomware, online scams and business email compromise.

Authorities:

• arrested 1,209 suspected cybercriminals
• identified nearly 88,000 victims
• dismantled 11,432 malicious infrastructures
• recovered approximately US$97.4 million

This demonstrates that cybercrime in Africa is increasingly organized, international and financially motivated.

15. Effects of Cybersecurity Attacks on Africa

Cyberattacks can have several major consequences.

Economic impact

Organizations and individuals can lose money through:

• fraud
• ransomware payments
• theft
• business interruption
• recovery costs

Social impact

Cybercrime can cause:

• privacy violations
• harassment
• sextortion
• identity theft
• loss of public trust

Government impact

Government systems can be targeted to:

• steal sensitive information
• disrupt public services
• compromise government databases
• undermine public confidence

Business impact

Companies can experience:

• financial losses
• operational disruption
• customer data loss
• reputational damage
• legal consequences

16. How African Countries Can Fight Cybercrime

There is no single solution. Cybersecurity requires a combination of technology, people, laws and cooperation.

1. Improve cybersecurity education

Schools, universities, businesses and governments should teach people how to identify:

• phishing
• scams
• malicious links
• social engineering
• unsafe passwords

2. Train more cybersecurity professionals

African countries need more:

• ethical hackers
• SOC analysts
• penetration testers
• digital-forensics specialists
• incident responders
• cybersecurity researchers

3. Strengthen laws

Countries need effective cybercrime and data-protection legislation.

4. Improve incident response

Organizations should have procedures for detecting, containing and recovering from cyberattacks.

5. Use strong authentication

Multi-factor authentication can significantly reduce the damage caused by stolen passwords.

6. Regularly update systems

Organizations should patch operating systems, applications and network devices to reduce exposure to known vulnerabilities.

7. Improve international cooperation

Because cybercrime crosses borders, African countries need to share:

• threat intelligence
• forensic information
• indicators of compromise
• investigative resources

INTERPOL's African Joint Operation against Cybercrime is one example of this type of cooperation.

17. Conclusion

Cybersecurity has become an important issue for Africa as the continent becomes increasingly connected.

The major threats include phishing and online scams, ransomware, business email compromise, digital sextortion, identity theft, data breaches, malware, DDoS attacks, financial fraud and attacks against critical infrastructure.

Although African countries have made significant progress in cybersecurity, attackers continue to exploit weaknesses in technology, human behaviour, organizational security and law enforcement capabilities.

The solution therefore requires more than simply installing antivirus software. Africa needs a combination of cybersecurity education, skilled professionals, strong laws, secure infrastructure, effective incident response, international cooperation and responsible use of emerging technologies.

The future of Africa's digital economy depends not only on connecting people to the internet, but also on ensuring that those connections are secure and trustworthy.