Nigeria Data Protection Commission (NDPC) has issued an urgent security advisory, warning Nigerians of critical vulnerabilities in Google Chrome that could expose users to severe cyber threats.

The alert, posted on the Commission’s official X handle, underscores the risks of these flaws and calls for immediate action to safeguard personal devices and data.

According to the NDPC, the vulnerabilities could allow attackers to execute arbitrary code on a user’s system, potentially granting unauthorised access to computers.

This could enable cybercriminals to install malicious programs, view, alter, or delete sensitive data, and even create new user accounts with full administrative rights.

Such breaches could disrupt device functionality, compromise personal information, and lead to significant loss of control over affected systems.

“Multiple vulnerabilities have been discovered in Google Chrome. The most severe of these could allow an attacker to take over a user’s system,” the NDPC stated, emphasising the urgency of addressing the issue.

To mitigate these risks, the Commission has advised Chrome users to apply the latest browser updates immediately.

It also recommends operating devices with standard user rights instead of administrative privileges to limit potential damage. Additionally, the NDPC urged Nigerians to exercise caution by avoiding suspicious links, unsolicited attachments, and untrusted websites.

The advisory comes as part of Nigeria’s broader efforts to strengthen data protection.

Microsoft said on Tuesday that it seized nearly 340 websites tied to a rapidly growing Nigerian-based service that allowed users to carry out phishing operations that stole at least 5,000 Microsoft user credentials.

Microsoft obtained an order from the U.S. District Court in Manhattan earlier this month to seize domains associated with Raccoon0365, the subscription service that allowed users to carry out massive phishing campaigns, which sometimes involved thousands of emails at a time, according to Steven Masada, assistant general counsel for Microsoft’s Digital Crimes Unit.

Raccoon0365’s service, which operates through a private Telegram channel with more than 850 subscribers, enables users to impersonate trusted brands and get targets to enter Microsoft login credentials on phony Microsoft login pages, Masada said in a blog posted on Microsoft’s website.

The service has generated for its small group of operators at least $100,000 in cryptocurrency payments since launching in July 2024, Masada said in the blog. Microsoft said the seizure of the websites occurred over a period of days earlier this month.

Microsoft identified Nigeria-based Joshua Ogundipe as the leader and main operator of Raccoon0365.

Ogundipe did not immediately respond to an email request for comment sent to the email address identified by Microsoft in its court filing.

“Cybercriminals don’t need to be sophisticated to cause widespread harm,” Masada said. “Simple tools like Raccoon0365 make cybercrime accessible to virtually anyone, putting millions of users at risk.”

Raccoon0365 subscribers have targeted a wide swath of industries, Masada said, and separate court filings allege that “a significant portion” of Raccoon0365 activity targets organizations based in New York City.

Masada said Microsoft identified what it said was a Raccoon0365-related effort using tax-themed phishing emails to target more than 2,300 organizations, mostly in the U.S., between February 12 and February 28 this year, according to a company blog posted in April.

Errol Weiss, chief security officer of the Health Information Sharing & Analysis Center (Health-ISAC), which provides cybersecurity services to member health organizations and is a co-plaintiff alongside Microsoft, said Raccoon0365 has been linked to successful credential harvesting through phishing campaigns at at least five unnamed healthcare organizations, while targeting 25 health sector organizations overall. Once hackers gain that access, any number of things can happen, Weiss said.

“So many of the attacks start because somebody gave up their user name and password to a bad guy,” Weiss said in an interview. “Once that cybercriminal has access to the network, then it’s just up to the imagination in terms of what comes next and how they monetize it.”

The Raccoon0365 operators used services provided by Cloudflare to help hide the service’s backend infrastructure, the internet services firm said in its own blog post. Cloudflare worked with Microsoft and the U.S. Secret Service to disrupt Raccoon0365 operations on its platform and prevent the operators from establishing new accounts, the company said.

Blake Darché, the head of threat intelligence at Cloudflare, said in an interview that the Raccoon0365 operators made some key operational security mistakes but were highly effective.

“They’re in people’s accounts, they compromise lots of people, and it needs to obviously be stopped,” he said.

A recent Kaspersky survey entitled “Cybersecurity in the workplace: Employee knowledge and behaviour”, showed that professionals surveyed in the Middle East, Turkiye and Africa (META) region, use multiple devices for work: along with a computer, 54,8% of respondents also use a mobile phone, and 34,7% use a tablet as well.

At the same time only 71% of respondents acknowledged having cybersecurity protection solutions installed on all devices that they use to access business information, and 6,6% of those surveyed don’t know if their devices are protected or not.

In today’s interconnected digital landscape, securing all devices used to access business data is essential to protect sensitive information and maintain operational integrity.

Devices that lack essential protection can be exploited by cyber attackers to gain unauthorised access, steal data, deploy ransomware, or disrupt business operations.

Within the past 12 months, 39,5% of respondents in the META region admitted to using their work devices for personal purposes (watching movies/ YouTube, playing games, shopping, holiday bookings, etc.), 32,2% connected work devices to public Wi-Fi networks, 9,8% lost their devices and 9,7% had their devices stolen.

These figures underline the need for a cyber hygiene mindset and security solutions for all endpoints, as each of them present cybersecurity risks to a business.

Personal use of work devices can lead to the installation of unauthorised apps or exposure to malicious websites, increasing the chance of malware infections or data leaks. Connecting to public Wi-Fi networks, which are often unencrypted and poorly secured, can allow cybercriminals to intercept sensitive business data or inject harmful software, so it should be secured with a VPN.

Additionally, if a device is lost or stolen and lacks proper security controls – like strong passwords, encryption, or remote wipe capabilities – critical business information could fall into the wrong hands.

“With the increasing reliance on cloud services, remote work, and mobile access, businesses need to implement comprehensive security measures. Cyber hygiene – or simply said good IT habits, security policies and the use of robust security solutions are essential practices for protecting business systems.

Security solutions should include endpoint protection for every device that accesses business information. Multi-factor authentication, regular software updates and backups are must haves now,” says Brandon Muller, Technical Expert for the MEA region at Kaspersky.