NITDA warns of AI malware targeting Nigerian institutions

n n

The National Information Technology Development Agency has issued a security alert over a new artificial intelligence-powered malware known as DeepLoad, warning that it is actively targeting government agencies, financial institutions, businesses, and individuals across Nigeria.

n

The warning was released on its X handle on Wednesday through the agency’s Computer Emergency Readiness and Response Team as cyberattacks against Nigerian organisations continue to rise.

n

According to the agency, DeepLoad is a highly advanced malware strain designed to steal sensitive information while avoiding detection by traditional antivirus systems. It spreads through social engineering tactics, particularly fake website error prompts that trick users into running malicious commands.

n

“The malware is distributed through a social engineering technique involving a fake website error,” NITDA stated in its advisory.

n

Once executed, the malware installs itself quietly on a device and begins extracting stored credentials and sensitive data from major web browsers. It then uses artificial intelligence techniques to help it evade detection and remain active.

n

“Once executed, DeepLoad silently installs itself, harvests stored credentials and sensitive data from major browsers, and leverages artificial intelligence to evade antivirus detection,” the agency said.

n

NITDA also warned that DeepLoad has a persistence mechanism that makes it especially difficult to remove. The malware can reactivate itself days after it appears to have been deleted.

n

“Critically, the malware incorporates a hidden WMI-based persistence mechanism capable of reactivating the infection up to three days after apparent removal,” the advisory stated.

n

The agency described the threat as serious and already active, urging immediate protective measures. “Given its severity and confirmed active targeting of Nigerian entities, all organizations and individuals must implement the protective measures outlined in this advisory immediately,” it added.

n

NITDA warned that individuals, businesses, and government institutions are all at risk. A successful infection could give attackers access to bank accounts, mobile money services, payment cards, passwords, and sensitive personal documents.

n

The agency also raised concerns about identity theft, saying stolen information could be used to impersonate victims for financial gain.

n

For organisations, NITDA said infections could lead to major operational disruptions, including system shutdowns and recovery processes. It also warned that breaches in government systems could compromise classified data and national security infrastructure.

n

To prevent infection, NITDA advised users not to copy or execute commands from unknown websites, stressing that legitimate software providers do not require such actions.

n

It also warned against installing software from unverified USB drives and recommended scanning all external storage devices before use.

n

Other key recommendations included “Enabling two-factor authentication on important accounts, avoiding storing banking passwords in browsers, reviewing browser extensions for suspicious activity, blocking known malicious domains at the firewall and DNS level, and enabling advanced logging tools on Windows systems

n

Organisations were also urged to educate staff, monitor systems for hidden persistence mechanisms, and immediately isolate any suspected infected devices.

n

NITDA concluded that any confirmed or suspected incident should be reported quickly, with affected systems disconnected from the internet, passwords reset from secure devices, and internal response teams activated within hours to contain the threat.

n n