News
Check Point Research Reveals XLoader as August’s Top Malware in Nigeria
Check Point Research (CPR), the Threat Intelligence arm of Check Point® Software Technologies, a provider of cyber security solutions globally, has published its latest Global Threat Index for August 2022.
![]()
In Nigeria, XLoader is the most widespread malware this month impacting 14.47% of organisations in the country, followed by Phorpiex and Guloader both with 6.58%.
Globally, CPR reports that FormBook is now the most prevalent malware, taking over from Emotet, which has held that position since its reappearance in January.
FormBook is an Infostealer targeting Windows OS which, once deployed, can harvest credentials, collect screenshots, monitor and log keystrokes as well as download and execute files according to its command and control (C&C) orders.
Since it was first spotted in 2016, it has continued to make a name for itself, marketed as a Malware as a Service (MaaS) in underground hacking forums, known for its strong evasion techniques and relatively low price.
August also saw a rapid increase in GuLoader activity, which resulted in it being the fourth most widespread malware. GuLoader was initially used to download Parallax RAT but has since been applied to other remote access trojans and infostealers such as Netwire, FormBook and Agent Tesla.
It is commonly distributed through extensive email phishing campaigns, that lure the victim into downloading and opening a malicious file, allowing the malware to get to work.
Additionally, Check Point Research reports that Joker, an Android spyware, is back in business and has claimed third place in the top mobile malware list this month. Once Joker is installed, it can steal SMS messages, contact lists and device information as well as sign the victim up for paid premium services without their consent. Its rise can partially be explained by an uplift in campaigns as it was recently spotted to be active in some Google Play Store applications.
“The shifts that we see in this month’s index, from Emotet dropping from first to fifth place to Joker becoming the third most prevalent mobile malware, is reflective of how fast the threat landscape can change” said Maya Horowitz, VP Research at Check Point Software.
“This should be a reminder to individuals and companies alike, of the importance of keeping up to date with the most recent threats as knowing how to protect yourself is essential.
“Threat actors are constantly evolving and the emergence of FormBook shows that we can never be complacent about security and must adopt a holistic, prevent-first approach across networks, endpoints and the cloud.”
CPR also revealed this month that the Education/Research sector is still the most targeted industry by cybercriminals globally. With Government/Military and Healthcare taking second and third place as the most attacked sectors.
“Apache Log4j Remote Code Execution” returns to first place as the most exploited vulnerability, impacting 44% of organizations worldwide, after overtaking “Web Server Exposed Git Repository Information Disclosure” which had an impact of 42%.
Top malware families
*The arrows relate to the change in rank compared to the previous month.
FormBook is the most widespread malware this month impacting 5% of organizations worldwide, followed by AgentTesla with an impact of 4% and XMRig with 2%.
- XLoader – XLoader is an Android Spyware and Banking Trojan developed by the Yanbian Gang, a Chinese hacker group. This malware uses DNS spoofing to distribute infected Android apps to collect personal and financial information..
- Phorpiex – Phorpiex is a botnet (aka Trik) that has been active since 2010 and at its peak controlled more than a million infected hosts. It is known for distributing other malware families via spam campaigns as well as fueling large-scale spam and sextortion campaigns.
- Guloader – GuLoader is a downloader that has been widely used since December 2019. When it first appeared, GuLoader was used to download Parallax RAT but has been applied to other remote access trojans and info-stealers such as Netwire, FormBook, and Agent Tesla.
Top Attacked Industries Globally
This month the Education/Research sector remained in first place as the most attacked industry globally, followed by Government/Military and Healthcare.
- Education/Research
- Government/Military
- Healthcare
Top Exploited Vulnerabilities
This month, “Apache Log4j Remote Code Execution” is the most common exploited vulnerability, impacting 44% of organizations globally, followed by “Web Server Exposed Git Repository Information Disclosure” which dropped from first place to second with an impact of 42%. “Web Servers Malicious URL Directory Traversal” remains in the third place, with a global impact of 39%.
- ↑ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
- ↓ Web Server Exposed Git Repository Information Disclosure – An information disclosure vulnerability has been reported in Git Repository. Successful exploitation of this vulnerability could allow unintentional disclosure of account information.
- ↔ Web Servers Malicious URL Directory Traversal (CVE-2010-4598,CVE-2011-2474,CVE-2014-0130,CVE-2014-0780,CVE-2015-0666,CVE-2015-4068,CVE-2015-7254,CVE-2016-4523,CVE-2016-8530,CVE-2017-11512,CVE-2018-3948,CVE-2018-3949,CVE-2019-18952,CVE-2020-5410,CVE-2020-8260) – There exists a directory traversal vulnerability on different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitize the URI for the directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server.
Top Mobile Malwares
This month AlienBot is the most prevalent Mobile malware, followed by Anubis and Joker.
- AlienBot – AlienBot is a banking Trojan for Android, sold underground as a Malware-as-a-Service (MaaS). It supports keylogging, dynamic overlays for credentials theft, as well as SMS harvesting for 2FA bypass. Additional remote control capabilities are provided by using a TeamViewer module.
- Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger and audio recording capabilities as well as various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
- Joker – An Android Spyware in Google Play, designed to steal SMS messages, contact lists and device information. Furthermore, the malware can also sign the victim up for paid premium services without their consent or knowledge.
Check Point’s Global Threat Impact Index and its ThreatCloud Map is powered by Check Point’s ThreatCloud intelligence. ThreatCloud provides real-time threat intelligence derived from hundreds of millions of sensors worldwide, over networks, endpoints and mobiles. The intelligence is enriched with AI-based engines and exclusive research data from Check Point Research, The Intelligence & Research Arm of Check Point Software Technologies.
News
Trump Threatens More Strikes in Nigeria

President Donald Trump has warned that the United States could carry out further military strikes in Nigeria if Christians continue to be killed, reigniting a sensitive debate over religious violence and foreign intervention in Africa’s most populous nation.

President Donald Trump
Trump made the remarks in an interview with The New York Times, published on Thursday, while responding to questions about a US military strike carried out in Nigeria on Christmas Day.
At the time, the US military said the operation targeted Islamic State militants in north-west Nigeria and was conducted at the request of the Nigerian government.
Nigeria, however, described the operation as a joint counterterrorism effort, stressing that it was aimed at armed groups designated as terrorists and “had nothing to do with a particular religion”.
“I’d love to make it a one-time strike,” Trump was quoted as saying. “But if they continue to kill Christians, it will be a many-time strike.”
Pressed on comments by his own Africa adviser that extremist groups such as Islamic State and Boko Haram have killed more Muslims than Christians in Nigeria, Trump acknowledged that Muslims were also victims but insisted that Christians were being targeted disproportionately.
“I think that Muslims are being killed also in Nigeria. But it’s mostly Christians,” he said.
Trump has repeatedly raised alarms about the safety of Christians in Nigeria, beginning in late October when he warned that Christianity faced what he described as an “existential threat” in the country. He has accused Nigerian authorities of failing to adequately protect Christian communities and has openly threatened US military intervention if the violence continues.
Nigeria has firmly rejected claims of systematic persecution of Christians. The government maintains that the country’s security challenges are complex and largely driven by insurgency, banditry and criminal violence rather than religious targeting.
With a population of more than 230 million people, Nigeria is almost evenly divided between Christians, who are concentrated mainly in the south, and Muslims, who predominate in the north. Islamist insurgencies, particularly Boko Haram and its offshoots, have plagued parts of northern Nigeria for more than a decade, killing thousands and displacing millions.
Nigerian authorities have repeatedly pointed out that militant attacks have claimed the lives of both Muslims and Christians, arguing that framing the violence along religious lines oversimplifies the crisis and risks inflaming tensions.
Following Trump’s earlier threats, the Nigerian government said it was willing to continue cooperating with Washington in combating terrorism but rejected language suggesting that Christians alone were under threat.
The latest comments are likely to strain diplomatic relations further, as Nigeria balances its partnership with the United States against concerns over sovereignty, security cooperation and the portrayal of its internal conflicts on the global stage.
News
OpenAI Launches ChatGPT Health

OpenAI maker of ChatGPT is rolling out a health-focused feature to the generative artificial intelligence (AI) tool that’s used by nearly a billion users.

Named ChatGPT Health, the new feature aims to provide users with health and wellness information. This, as health is one of the most common ways people use ChatGPT, according to OpenAI.
In a blog post, Microsoft-backed OpenAI says de-identified analysis of conversations show that over 230 million people globally ask health and wellness-related questions on ChatGPT every week.
ChatGPT Health will also “securely” connect medical records and wellness apps to ground conversations with a user’s own health information, making responses more relevant and useful.
“Designed in close collaboration with physicians, ChatGPT Health helps people take a more active role in understanding and managing their health and wellness – while supporting, not replacing, care from clinicians.”
According to OpenAI, health information is often scattered across portals, apps, wearables, PDFs, and medical notes making it hard to see the full picture, and people are left to navigate a complex healthcare system on their own.
“ChatGPT Health builds on these so responses are informed by your health information and context. You can now securely connect medical records and wellness apps – like Apple Health, Function, and MyFitnessPal – so ChatGPT can help you understand recent test results, prepare for appointments with your doctor, get advice on how to approach your diet and workout routine, or understand the trade-offs of different insurance options based on your healthcare patterns.”
According to the company, ChatGPT Health is designed to support, not replace, medical care, adding that it is not intended for diagnosis or treatment. “Instead, it helps you navigate everyday questions and understand patterns over time – not just moments of illness – so you can feel more informed and prepared for important medical conversations.
“To keep your health information protected and secure, Health operates as a separate space with enhanced privacy to protect sensitive data. Conversations in Health are not used to train our foundation models. If you start a health-related conversation in ChatGPT, we’ll suggest moving into Health for these additional protections.”
OpenAI adds that access to ChatGPT Health has started with a small group of early users to learn and continue refining the experience, adding that users with ChatGPT Free, Go, Plus, and Pro plans outside of the European Economic Area, Switzerland, and the UK are eligible.
“As we make improvements, we plan to expand access and make Health available to all users on web and iOS in the coming weeks.
“Medical record integrations and some apps are available in the US only, and connecting Apple Health requires iOS.”
News
Kaspersky Shares AI Cybersecurity Predictions for 2026

Kaspersky experts outline how the rapid development of AI is reshaping the cybersecurity landscape in 2026, both for individual users and for businesses. Large language models (LLMs) are influencing defensive capabilities while simultaneously expanding opportunities for threat actors.

Deepfakes are becoming a mainstream technology, and awareness will continue to grow. Companies are increasingly discussing the risks of synthetic content and training employees to reduce the likelihood of falling victim to it. As the volume of deepfakes grows, so does the range of formats in which they appear.
At the same time, awareness is rising not only within organisations but also among regular users: end consumers encounter fake content more often and better understand the nature of such threats. As a result, deepfakes are becoming a stable element of the security agenda, requiring a systematic approach to training and internal policies.
Deepfake quality will improve through better audio and a lowering barrier to entry. The visual quality of deepfakes is already high, while realistic audio remains the main area for future growth.
At the same time, content generation tools are becoming easier to use: even non-experts can now create a mid-quality deepfake in just a few clicks. As a result, the average quality continues to rise, creation becomes accessible to a far broader audience, and these capabilities will inevitably continue to be leveraged by cybercriminals.
Online deepfakes will continue to evolve but remain tools for advanced users. Real-time face and voice swapping technologies are improving, but their setup still requires more advanced technical skills. Wide adoption is unlikely, yet the risks in targeted scenarios will grow: increasing realism and the ability to manipulate video through virtual cameras make such attacks more convincing.
Efforts to develop a reliable system for labelling AI-generated content will continue. There are still no unified criteria for reliably identifying synthetic content, and current labels are easy to bypass or remove, especially when working with open-source models. For this reason, new technical and regulatory initiatives aimed at addressing the problem are likely to emerge.
Open-weight models will approach top closed models in many cybersecurity-related tasks, which create more opportunities for misuse. Closed models still offer stricter control mechanisms and safeguards, limiting abuse.
However, open-source systems are rapidly catching up in functionality and circulate without comparable restrictions. This blurs the difference between proprietary models and open-source models both of which can be used efficiently for undesired or malicious purposes.
The line between legitimate and fraudulent AI-generated content will become increasingly blurred. AI can already produce well-crafted scam emails, convincing visual identities, and high-quality phishing pages.
At the same time, major brands are adopting synthetic materials in advertising, making AI-generated content look familiar and visually “normal.” As a result, distinguishing real from fake will become even more challenging, both for users and for automated detection systems.
AI will become a cross-chain tool in cyberattacks and be used across most stages of the kill chain. Threat actors already employ LLMs to write code, build infrastructure, and automate operational tasks.
Further advances will reinforce this trend: AI will increasingly support multiple stages of an attack, from preparation and communication to assembling malicious components, probing for vulnerabilities and deploying tools. Attackers will also work to hide signs of AI involvement, making such operations harder to analyse.
“While AI tools are being used in cyberattacks, they are also becoming a more common tool in security analysis and influence how SOC teams work. Agent-based systems will be able to continuously scan infrastructure, identify vulnerabilities, and gather contextual information for investigations, reducing the amount of manual routine work.
“As a result, specialists will shift from manually searching for data to making decisions based on already-prepared context. In parallel, security tools will transition to natural-language interfaces, enabling prompts instead of complex technical queries,” adds Vladislav Tushkanov, Research Development Group Manager at Kaspersky.
General News2 days agoPawnith Appoints Martina Ogbebor as Managing Director to Lead Strategic Launch into Nigeria’s Fintech Ecosystem
E-Financial2 days agoBVN Enrollment Up 6.87 Percent to 67.84m in 2025 – NIBSS
News2 days agoOpenAI Launches ChatGPT Health
E-Business2 days agoStudy Reveals Majority of IT Professionals Show Openness to Cyber Immunity
E-Financial1 day ago19 Nigerian Banks Meet CBN Recapitalization Targets Ahead of March Deadline
Telecom2 days agoNCC, CBN Unveil Refund Framework for Failed Airtime, Data Transactions
E-Financial1 day agoKPMG Identifies ‘Flaws, Inconsistencies, and Omission’ in New Tax Law
News2 days agoTrump Threatens More Strikes in Nigeria
















