Connect with us

E-Business

Qbot Emerges Most Prevalent Malware in First Half of 2023, Mobile Trojan SpinOk Makes its Debut

Published

on

Kindly share this post

Check Point® Software Technologies, a provider of cybersecurity solutions globally, has published its Global Threat Index for June 2023. Researchers found that the Trojan Qbot has been the most prevalent malware so far in 2023, ranking first in five out of the six months to date.

Meanwhile, mobile Trojan SpinOk made its way to the top of the malware list for the first time after being detected last month, and ransomware hit headlines following a zero-day vulnerability in file sharing software MOVEIt.

Qbot, which initially emerged in 2008 as a banking Trojan, has undergone consistent development, acquiring additional functionalities for the purpose of stealing passwords, emails, and credit card details.

It is commonly propagated through spam emails and employs various techniques such as anti-VM, anti-debugging, and anti-sandbox methods to impede analysis and avoid detection.

Presently, its primary role is to act as a loader for other malware and establish a presence within targeted organizations, serving as a stepping stone for ransomware group operators.

Meanwhile, researchers discovered a prolific mobile malware that has so far amassed 421 million downloads. Last month, for the first time, Trojanized Software Development Kit (SDK) SpinOk made its way to the top of the mobile malware families. Used by numerous popular apps for marketing purposes, this malicious software has infiltrated highly popular apps and games, some of which were available on the Google Play Store.

Capable of stealing sensitive information from devices and monitoring clipboard activities, SpinOk malware poses a serious threat to user privacy and security, underscoring the need for proactive measures to protect personal data and mobile devices. It also serves as a stark reminder of the devastating potential of software supply chain attacks.

Last month also saw the launch of a large-scale ransomware campaign that impacted organizations worldwide. In May 2023, Progress Software Corporation disclosed a vulnerability in MOVEit Transfer and MOVEit Cloud (CVE-2023-34362) that could allow unauthorized access to the environment.

Despite it being patched within 48 hours, cybercriminals associated with Russian-affiliated ransomware group Clop exploited the vulnerability and launched a supply chain attack against MOVEit users.

To date, 108 organizations – including seven US universities – have been listed publicly, following the incident, with hundreds and thousands of records obtained.

“The MOVEit exploit proves that 2023 is already becoming a significant year in ransomware. Prominent groups like Clop are not operating tactically to infect a single target, but instead, making their operations more efficient by exploiting software that is widely used in a corporate environment.

This approach means they can reach hundreds of victims in a single attack.” said Maya Horowitz, VP Research at Check Point Software. “This attack pattern emphasizes the importance for companies to implement a multi-layered cyber security strategy and to prioritize patching quickly when vulnerabilities are disclosed.”

CPR also revealed that “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability last month, impacting 51% of organizations globally, followed by “Apache Log4j Remote Code Execution” with 46% of organizations worldwide. “HTTP Headers Remote Code Execution” was the third most used vulnerability, with a global impact of 44%.

Top malware families

Globally, Qbot was the most prevalent malware last month with an impact of 7% worldwide organizations, followed by Formbook with a global impact of 4% and Emotet with a global impact of 3%.

In Nigeria, Qbot was the most prevalent malware last month with an impact of 19.72%, followed by Expiro with an impact of 15.49% and FormBook with an impact of 7.04%.

  1. Qbot – Qbot AKA Qakbot is a multipurpose malware that first appeared in 2008. It was designed to steal a user’s credentials, record keystrokes, steal cookies from browsers, spy on banking activities, and deploy additional malware. Often distributed via spam email, Qbot employs several anti-VM, anti-debugging, and anti-sandbox techniques to hinder analysis and evade detection.
  1. Expiro – Expiro is a polymorphic file infector first seen in 2010. It inserts its malicious code into executable files on the infected host. These files lead to new infections when they are run on other machines. Expiro steals user and system information from Windows, as well as FTP credentials.
  1. FormBook – FormBook is an Infostealer targeting the Windows OS and was first detected in 2016. It is marketed as Malware as a Service (MaaS) in underground hacking forums for its strong evasion techniques and relatively low price. FormBook harvests credentials from various web browsers, collects screenshots, monitors and logs keystrokes, and can download and execute files according to orders from its C&C.

Top Attacked Industries Globally

Last month, Communications remained in first place as the most exploited industry globally, followed by Utilities and Transportation.

  1. Communication
  2. Utilities
  3. Transportation

Top exploited vulnerabilities

Last month, “Web Servers Malicious URL Directory Traversal” was the most exploited vulnerability, impacting 51% of organizations globally, followed by “Apache Log4j Remote Code Execution” with 46% of organizations worldwide. “HTTP Headers Remote Code Execution” was the third most used vulnerability, with a global impact of 44%.

  1. ↔ Web Servers Malicious URL Directory Traversal – There exists a directory traversal vulnerability on different web servers. The vulnerability is due to an input validation error in a web server that does not properly sanitize the URI for the directory traversal patterns. Successful exploitation allows unauthenticated remote attackers to disclose or access arbitrary files on the vulnerable server.
  1. ↔ Apache Log4j Remote Code Execution (CVE-2021-44228) – A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system.
  1. ↔ HTTP Headers Remote Code Execution (CVE-2020-10826, CVE-2020-10827, CVE-2020-10828, CVE-2020-13756) – HTTP headers let the client and the server pass additional information with an HTTP request. A remote attacker may use a vulnerable HTTP Header to run arbitrary code on the victim machine.

Top Mobile Malwares

Last month SpinOk rose to first place in the most prevalent Mobile malware, followed by Anubis and AhMyth.

  1. SpinOk – SpinOk is an Android software module that operates as spyware. It collects information about files stored on devices and is capable of transferring them to malicious threat actors. The malicious module was found present in more than 100 Android apps and downloaded more than 421,000,000 times until May 23.
  1. Anubis – Anubis is a banking Trojan malware designed for Android mobile phones. Since it was initially detected, it has gained additional functions including Remote Access Trojan (RAT) functionality, keylogger, audio recording capabilities and various ransomware features. It has been detected on hundreds of different applications available in the Google Store.
  1. AhMyth – AhMyth is a Remote Access Trojan (RAT) discovered in 2017. It is distributed through Android apps that can be found on app stores and various websites. When a user installs one of these infected apps, the malware can collect sensitive information from the device and perform actions such as keylogging, taking screenshots, sending SMS messages, and activating the camera, which usually used to steal sensitive information.

Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

E-Business

Report Reveals Half of 2025’s Compromised Passwords were Already Leaked

Published

on

Kindly share this post

Kaspersky’s latest research reveals that the majority of compromised passwords not only violate password-safety guidelines but also remain unchanged for extended periods, which drastically reduces their security.

To provide users with access to more sophisticated and modern ways to log in, Kaspersky’s Password Manager has been enhanced with Passkey technology, enabling users to securely access their accounts while enjoying seamless cross-device synchronisation.

Although passwords still remain one of the major authentication methods, they no longer top the security charts. Often crafted by users themselves, passwords are heavily influenced by human factors, which makes them potentially vulnerable. Kaspersky experts analysed major password leaks from 2023 to 2025 and identified several recurring patterns:

  • Users frequently append predictable elements like numbers, dates, and personal identifiers to their passwords. For example, 10% of passwords in datasets analysed contain a number resembling a date (from 1990 to 2025), 0.5% of all leaked passwords end with the number 2024, which is every 200th password!
  • The most commonly occurring password combination is ‘12345’, which drastically reduces cryptographic strength and shortens the time required for brute-force attacks to succeed. Among other popular password components are the word ‘love’ and users’ names, as well as countries’ names which are also often included in passwords.
  • Moreover, the majority of leaked passwords remain unchanged for years. In 2025, 54% of leaked passwords had already been part of prior data breaches, underscoring widespread reuse of outdated passwords. According to data analysis the average lifetime of the password found in these leaks is 3.5-4 years. 

What makes Passkeys more secure?

All these findings highlight the critical vulnerability of password-based authentication when protocols for creation, management, and storage are not rigorously followed. In response to the growing need for robust security, the industry is increasingly shifting its focus toward next-generation solutions like Passkeys, which offer stronger protection against evolving threats.

Passkey technology is based on cryptographic keys and biometrics and is not subjected to threats like phishing or data leaks. A passkey is created for a particular account on a particular platform and is stored directly on the user’s device or in a password manager.

New Passkey feature in Kaspersky Password Manager

When a user registers on a platform that supports Passkey, the device creates a private key and shares a public key with the service. The private key is stored directly on the device, which is good from a security point of view, but complicates authorisation from other devices.

Now Passkeys can be created and stored directly in Kaspersky Password Manager, which allows users to not only sign in to supported services with a single tap, but also access Passkeys on all their devices owing to secure synchronisation.

“From our own experience, we’ve seen how constantly juggling logins and passwords for work, study and even leisure can erode both time and security. Kaspersky Password Manager has long streamlined this process with tools like our secure password generator and auto-fill functionality – ensuring users never sacrifice safety for speed.

In addition to that, we are happy to offer to our customers a new Passkey feature – an enhanced level of accounts protection which makes authentication even simpler and, most importantly, more secure,” comments Marina Titova, Vice President for Consumer Business at Kaspersky.

Passkey functionality is now available on all platforms in the latest version of Kaspersky Password Manager. To create a passkey in Kaspersky Password Manager, first update the app to the latest version and grant it all necessary permissions. Then, open the website where you want to create the passkey and simply follow the in-app guidance to register and save it.

 


Kindly share this post
Continue Reading

E-Business

UBA Wins Africa’s Bank of the Year for Third Time in Five Years

Published

on

Kindly share this post

Africa’s Global Bank, United Bank for Africa (UBA) Plc, has once again, reaffirmed its leadership as one of the continent’s most innovative and resilient financial institutions, as the bank has, for the third time in five years, been named the African Bank of the year 2025 by the Banker.com.

UBA Wins Africa’s Bank of the Year for Third Time in Five Years

UBA

UBA also won the Best Bank of the Year awards in nine of its 20 African subsidiaries, bringing its total awards this year to ten as UBA Benin, UBA Chad, UBA Republic of Congo (Congo-Brazzaville), UBA Liberia, UBA Mali, UBA Mozambique, UBA Senegal, UBA Sierra Leone, and UBA Zambia, all came out tops as the best banks in their respective countries, underscoring the bank’s strength across West, Central and Southern Africa and highlighting the depth of its Pan-African franchise.

The Banker.com, a leading global finance news publication published by the Financial Times of London, organises the annual Bank of the Year Awards, and this year’s edition was held at a grand ceremony at the Peninsula, London, on Wednesday.

The Chief Executive Officer, UBA UK, Deji Adeyelure, received the awards on behalf of the bank, representing the Group Managing Director/CEO, Oliver Alawuba, and was accompanied by the bank’s Head Business Development, Mark Ifashe, and Head, Financial Institutions, Shilpam Jha.

The Banker’s awards are widely regarded as the most respected and rigorous in the global banking industry, celebrating institutions that demonstrate outstanding performance, innovation and strategic execution.

In its remarks on UBA’s winnings, the banker.com said, “For the third time in five years, UBA Group has won the coveted Bank of the Year award for Africa. UBA Group time after time punches above its weight against its larger African rivals. The bank this year also takes home nine separate country awards (one more than it gained for its last continental win in 2024), equivalent to around a quarter of the awards for the continent, and more than any of its continent-wide rivals.”

Continuing, it said, “Perhaps even more impressive is the fact that the awards were won across a broad geographic spread, going to lenders based in the Economic Community of West African States (Benin, Liberia, Senegal, Sierra Leone, and former member Mali), the Central African Economic and Monetary Community (Chad, Republic of Congo) and the Southern African Development Community (Mozambique, Zambia). Its award wins were particularly notable in the highly competitive categories for Benin and Mozambique.”

The Banker also highlighted UBA’s strong financial performance and commitment to future growth. In 2024, the Group recorded a 46.8 per cent increase in assets and a 6.1 per cent rise in pre-tax profits in local currency terms, while continuing to invest significantly in talent and technology. West Africa remains UBA’s heartland, with operating revenue and profit increasing by 87 per cent and 89 per cent respectively in H1 2025.

The bank’s digital and innovation leadership was equally recognised. During the year under review, and launched its Advance Top-Up buy-now-pay-later feature on the *919# USSD platform, expanding financial access for customers, while the bank’s chatbot Leo continued its strong growth trajectory, with transaction volumes rising by 29 per cent year-on-year in H1 2025. Notably, in August, Leo became the first African banking chatbot to enable cross-border payments via the Pan-African Payment and Settlement System (PAPSS).

UBA’s Group Managing Director/Chief Executive Officer, Oliver Alawuba, while reacting to the achievement, said the recognition affirms the bank’s long-term strategy and customer-first philosophy.

“This honour reflects the strength of our Pan-African network, the trust of our customers, and the dedication of our people. Winning Africa’s Bank of the Year for the third time in five years is not by chance; it is a testament to disciplined execution, innovation, and a deep understanding of the markets we serve,” Alawuba said.

“Our nine country awards across diverse regions of Africa show that UBA is not just growing, but growing with impact. We remain committed to driving financial inclusion, supporting economic development, and deploying technology that makes banking simpler, faster, and more accessible to Africans everywhere,” he added.

United Bank for Africa is one of the largest employers in the financial sector on the African continent, with 25,000 employees group-wide and serving over 45 million customers globally. Operating in twenty African countries, the United Kingdom, the United States of America, France and the United Arab Emirates, UBA provides retail, commercial and institutional banking services, leading financial inclusion and implementing cutting-edge technology.

 

 


Kindly share this post
Continue Reading

E-Business

GenAI Adoption Among African workers Outpace Global Peers

Published

on

Kindly share this post

Africa’s workforce is embracing artificial intelligence (AI) at a faster pace than global peers, but pressure is mounting for organisations to ramp up digital skills development as generative AI (GenAI) begins reshaping roles across industries.

This is according to PwC’s Global Workforce Hopes and Fears Survey 2025, which shows a continent ready for AI-enabled transformation, but facing a narrowing window to prepare, through skills development initiatives.

The survey, covering nearly 50 000 workers worldwide and 1 753 across South Africa, Algeria, Kenya, Morocco and Nigeria, finds that African employees are already integrating AI into daily operations.

Sixty-four percent of respondents in Africa used AI tools in the past year, compared to 54% globally, and the sentiment is overwhelmingly positive. While only 17% report using GenAI every day, confidence in its benefits is high: 76% believe GenAI improves work quality, and 72% expect AI-driven productivity gains within three years.

In SA, executives are even more bullish, as 91% say AI has already lifted both productivity and work quality — a signal that leadership is pushing harder toward AI-enabled ways of working, notes the survey.

However, this optimism is coupled with rising concern about future readiness. Only 35% of African workers believe their skills will still be relevant three years from now. With GenAI expected to affect nearly half of all job roles, PwC warns that the continent’s workforce risks falling behind unless organisations accelerate large-scale reskilling.

Despite the pressures, employees are not standing still. PwC notes that African workers outperform their global peers in proactive learning, recording 15% higher participation in skills-building and receiving 6% more support from managers. This indicates that both workers and immediate supervisors recognise the pace of AI adoption and are pushing to adapt.

PwC Africa people and organisation leader, Dr Dayalan Govender, says the moment calls for decisive leadership. Organisations, he argues, must integrate AI into workforce strategies, accelerate digital adoption, and expand upskilling programmes at scale.

“Africa’s workforce is optimistic and ready for change, but leaders must accelerate digital adoption and invest in future-ready skills to convert this optimism into sustainable growth,” he says.

Beyond the technology shift, the survey captures a workforce hungry for growth but constrained by financial pressure. Many employees are preparing to make career moves: 45% plan to request a raise, and another 45% aim for a promotion in the next year. Yet household financial stability remains strained, with only a third of respondents reporting any money left over for savings.

Still, Africa’s workplaces continue to show strong foundations of trust and purpose — elements PwC believes will be critical in navigating GenAI disruption. More than 55% of workers trust management, and two-thirds say their work feels meaningful, both above global averages.

With AI adoption rising and employees motivated to reinvent their careers, PwC warns that the coming years will determine whether Africa’s early optimism translates into long-term competitiveness as GenAI transforms the world of work.

The report calls for embedding AI into workforce strategies to bridge the gap between optimism and practical adoption, scaling upskilling initiatives to prepare for GenAI disruption, and fostering trust and psychological safety to retain talent and drive innovation.

“For employers, these findings are a stark reminder that they can and should do more to help workers understand, adopt, and embrace AI’s transformative power.

“Employers may need to pay special attention to entry-level workers, nearly a third of whom say they’re worried to a large or very large extent about AI’s impact on their future, even as they’re also curious (47%) and optimistic (38%) about its long-term societal effects,” notes the report.


Kindly share this post
Continue Reading

Trending