Recent research by Kaspersky has shown that the so-called “grey” websites repeatedly target all world regions, and this may be driving both financial loss and large-scale data harvesting.

Grey websites are deceptive online platforms that fall outside traditional phishing definitions but still manipulate users into voluntarily handing over money and personal data. Kaspersky’s new report provides detailed insights into the threats posed by the grey websites on global and regional levels.

Unlike classic phishing attacks, which aim to steal credentials outright, grey websites rely on persuasion, misleading interfaces, and hidden terms to exploit users. They often impersonate legitimate services such as e-commerce platforms, financial tools, AI services, or subscription-based content, making them significantly harder to detect.

Kaspersky analysis shows that the majority of suspicious resources globally fall into several recurring categories:

• Fake browser extensions and “security tools” that actually harvest browsing data and track user activity.
• Fraudulent financial platforms including crypto exchanges, trading tools, and investment schemes promising unrealistic returns.
• Intermediary services (e.g., legal or real estate), charging for low-value or nonexistent services while harvesting sensitive personal data.
• Subscription traps offering low-cost trials that convert into costly recurring payments hidden in fine print.
• Fake online shops that either deliver counterfeit goods or nothing at all.

Example of a grey website.

A notable trend is the emergence of tools disguised as AI services or image-processing platforms, reflecting attackers’ ability to adapt to current digital trends and target younger audiences.

There are proven security solutions that help users to detect grey websites across different types of devices – those running on Windows, Linux, Android and iOS. The detection model is based on many factors, including domain name and age, IP reputation, stability of the infrastructure used, DNS configurations, HTTP security headers, digital identity and popularity of the web resource and other criteria.

Regional specifics

Regional variations in grey websites demonstrate how threat actors localise scams based on user behaviour and trending technologies.

In Europe, the threat landscape is dominated by links to suspicious browser extensions and fake “privacy-enhancing” tools.

These resources often present themselves as security solutions, promising safer browsing or anonymous search capabilities. In reality, they function as browser hijackers – intercepting traffic, collecting cookies, tracking user behaviour, and injecting advertisements.

The popularity of these threats reflects a high level of user concern around privacy and security, which attackers actively exploit. Additionally, these regions show a steady presence of phishing intermediaries and crypto-related scams, indicating a blend of technical and financially motivated attacks.

Across African markets, financial scams are the most prominent category of suspicious resources. Fraudulent trading platforms, fake brokers, and investment schemes frequently mimic legitimate financial services, often accompanied by fabricated licenses or endorsements.

These platforms typically prevent users from withdrawing funds, instead introducing additional “fees” or taxes to prolong the scam. The concentration of these threats highlights how attackers leverage growing interest in online investing while exploiting gaps in regulatory enforcement and financial literacy.

In the Middle East and North Africa region, suspicious resources frequently mimic communication (Internet telephony) tools, financial platforms, or betting services. Additionally, Ponzi-style investment schemes and crypto scams are widespread, often presented through polished interfaces that mimic legitimate platforms.

Web browser-based threats also play a significant role, with malicious extensions targeting user data and browsing activity. The regional threat profile reflects a convergence of financial fraud and technical compromise, where users risk both data exposure and monetary loss.

“Suspicious websites don’t look harmful at first glance. But they exploit trust, urgency, and familiarity, and a single click on what looks like a harmless AI image tool, a “secure” browser extension, or a heavily discounted online shop could be all it takes to lose money or expose sensitive data.

Instead of direct credential theft, attackers turn to behavioural manipulation – whether that’s subscribing, investing, or installing software,” comments Anna Larkina, Web Content and Privacy Analysis Expert at Kaspersky.

Businesses across Nigeria, particularly micro, small and medium enterprises (MSMEs), may soon be able to convert unpaid invoices and credit sales into immediate cash without relying on conventional bank loans following the passage of the Factoring, Assignments and Receivables Financing Bill for second reading in the Senate.

The bill, which seeks to establish a legal framework for factoring and receivables financing, is expected to improve access to credit, boost liquidity for businesses and enhance domestic and international trade.

It also seeks to provide legal certainty for the assignment of receivables through factoring, promote transparency, modernise assignment laws and facilitate greater access to credit for businesses across the country.

Leading debate on the bill which was sent from the House of Representatives for concurrence, Senate Leader Opeyemi Bamidele said on Tuesday that the proposed legislation would create an enabling environment for debt factoring to thrive in Nigeria while defining the rights and obligations of creditors, factors and debtors involved in such transactions.

He explained that the bill provides for factoring contracts between sellers and factors and clarifies the legal relationship among parties in receivables financing arrangements.

According to Bamidele, the legislation has already passed all legislative stages in the House of Representatives and has complied with the Senate’s procedural requirements under Order 78(3) of the Senate Standing Orders.

He told lawmakers that the Senate Ad Hoc Committee on Compliance, chaired by Abdul Ningi, had scrutinised and cleared the bill for concurrence.

“The committee confirmed that all procedural requirements for consideration and concurrence by the Senate have been fully met,” he said.

Seconding the bill, Adetokunbo Abiru said the legislation would provide businesses with an alternative source of financing by enabling them to turn credit sales into cash and improve their working capital.

Abiru noted that factoring has become increasingly popular across Africa over the last decade, largely through initiatives supported by the African Export-Import Bank (Afreximbank).

He disclosed that the African factoring market is currently valued at over $50 billion, but Nigeria’s participation remains below one per cent.

According to him, countries such as Egypt and Morocco have benefited significantly from the financing model, adding that Nigeria risks missing out on the growing market without a clear regulatory framework.

“I think that passing this major legislation will help support our micro, small and medium enterprises in terms of converting most of their credit sales into cash without going through the normal borrowing arrangement,” Abiru said.

In his remarks, Ningi also assured lawmakers that the compliance committee had reviewed the bill and found no legal impediments to its passage.

Following a voice vote, the Senate approved the bill for second reading and subsequently referred it to the Committee of the Whole for clause-by-clause consideration.

The IMF on Tuesday warned of risks surrounding Nigeria’s plan to borrow up to $5 billion through a derivatives agreement with ‌First Abu Dhabi Bank, saying such transactions are often opaque and complex.

Recall that the Senate in April gave its approval to the agreement, joining other Africa borrowers like Senegal and Angola who have tapped similar arrangements over the past year.

“Our view is that the transaction in these types of structures carry risks. Usually they are opaque so the terms are not always very transparent when we reviewed these instruments ​across countries,” Christian Ebeke, IMF resident representative in Nigeria, told reporters.

Ebeke said Nigeria could instead issue eurobonds to finance its deficits or other means to raise funding, including on concessional terms.

Nigeria intends to use proceeds from the total return swap, or TRS, to refinance expensive debt and pay for infrastructure.

In its latest Article IV review, the Fund praised Nigeria’s sweeping reforms, saying they had strengthened economic stability and investor confidence, but warned that the benefits had ‌yet to reach millions of citizens and could be undermined by global shocks, including the Middle East conflict.

The reforms since 2023 under President Bola Tinubu – including fuel subsidy removal, tighter monetary policy and exchange rate liberalisation – had rebuilt buffers and improved macroeconomic management, the IMF said.

However, it cautioned that the reforms were also contributing to social strain, with poverty levels at 63% and millions facing food insecurity, underscoring a widening gap between macro gains and household realities.

The IMF said improved policy credibility and forex reforms had helped Nigeria regain access to international capital markets and attract portfolio inflows, while reducing risk premiums. The central bank says gross reserves are at $50 billion, the highest in 17 years.

But reliance on volatile foreign portfolio investment poses rollover risks, the IMF said, urging a shift towards more stable, long-term capital such as foreign direct investment.