Connect with us

E-Business

Scammers go ‘InterPlanetary’ Using a Decentralised File System in their Attacks

Published

on

Kindly share this post

Kaspersky experts have discovered how cybercriminals are using the InterPlanetary File System (IPFS) in email phishing attacks. Since late 2022, fraudsters have been using this safe, decentralised and reliable way for file distribution – considered to be one of the cutting-edge technologies of Web 3.0 – to target companies around the world.

In a new report by Kaspersky, researchers reveal how attackers are putting phishing HTML files in IPFS to cut web hosting costs.

This technique, used for both ongoing mass and targeted phishing campaigns, saw almost 400,000 phishing emails detected in February 2023.

IPFS is a peer-to-peer distributed file system enabling users around the world to exchange files. Unlike centralised systems, IPFS uses addressing performed according to unique content identifiers (CID), and not file paths.

The file itself resides on the computer of the user who had “uploaded” it to IPFS and downloaded directly from that computer.

By default, uploading or downloading a file to IPFS requires special software (IPFS client). For users to view the files residing in IPFS freely without installing any software, the so-called gateways are provided.

In 2022, scammers began actively using IPFS for email phishing attacks. They place HTML files containing a phishing form in IPFS and use gateways as proxies, so that victims can open the file, whether or not they are running an IPFS client on their devices.

The scammers also include file access links via a gateway into phishing letters dispatched to would-be victims.

The use of a distributed file system allows attackers to cut back on phishing page hosting costs. Besides, it’s impossible to delete files uploaded by third parties from IPFS.

If somebody wants a file to disappear from the system completely, they can urge its owners to delete it, but the method will probably never work with cybercriminals anyway.

IPFS gateway providers attempt to combat IPFS phishing by regularly deleting links to fraudulent files.

Yet detection and deletion of links at gateway level does not always happen as quickly as the blocking of a phishing website, cloud form, or document. The URL addresses of IPFS files first appeared in October 2022. As for now, the campaign is ongoing and being blocked by Kaspersky.

Phishing letters containing IPFS links are hardly ever too original — they contain the typical phishing content the purpose of which is to obtain the victim’s account login and password. What is interesting about this technique is where the HTML page links go.

The URL parameter contains the recipient’s email address. Once modified, the corporate logo on top of the phishing form and email address entered into the login field will change too. This way, one link can be used in several phishing campaigns targeting different users — sometimes even in dozens of campaigns.

In late 2022, Kaspersky observed up to 15,000 IPFS phishing letters-a-day for most of the time. Starting this year, IPFS phishing began to grow in scale, reaching more than 24,000 letters-a-day in January and February.

February was the busiest month in terms of IPFS phishing activity. In that month alone, researchers observed almost 400,000 letters – a 100,000 increase than in November and December 2022.

“Attackers have and will continue to use cutting-edge technologies to reap profits. As of late, we have observed an increase in the number of IPFS phishing attacks — both mass and targeted.

“The distributed file system allows scammers to save money on domain purchase. Plus, it is not easy to completely delete a file, although, there are attempts to combat fraud at IPFS gateway level.

“The good news is that anti-spam solutions detect and block links to phishing files in IPFS, just like any other phishing links. In particular, Kaspersky products employ a number of heuristics to detect IPFS phishing,” comments Roman Dedenok, a security expert at Kaspersky.


Kindly share this post

Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

E-Business

NITDA Advocates AI, Security Integration for Sustainable Development

Published

on

Kindly share this post

Kashifu Inuwa, CCIE, the Director General of the National Information Technology Development Agency (NITDA), has emphasised that integrating intelligence, security, and sustainability is critical to driving Nigeria’s digital transformation and global competitiveness.

Inuwa made the remarks on Tuesday in Kano while delivering a goodwill message at the opening of the 19th International Conference (CONNOVATE 2025) of the Nigerian Computer Society (NCS), themed “Intelligent, Secure, and Sustainable Innovations for a Connected World.”

Represented by Engr. Salisu Kaka, Director of E-Government and Digital Economy Development, Inuwa said the three elements were now indispensable drivers of national progress. He highlighted the need for their convergence to unlock new opportunities in Nigeria’s technology sector, citing Estonia’s X-Road platform — which enables 99% of government services online — as a global model.

“In Nigeria, trust is the ultimate currency in our high-stakes digital environment, where scams and cybercrime are prevalent. Security builds and protects this trust,” Abdullahi said.

He stressed that while security provides the foundation, intelligence builds the structure, pointing to Artificial Intelligence (AI), Machine Learning (ML), and data analytics as tools for addressing Nigeria’s complex challenges. Warning that “innovation without security is unsustainable,” he likened it to “a high-performance race car without brakes.”

The DG urged the next wave of Nigerian startups to go beyond digitising existing processes to creating new value, citing AI-powered wealth management and ML-driven remote diagnostics as examples.

He further highlighted the various Federal Ministry of Communications, Innovation and Digital Economy (FMCIDE) initiatives supporting this vision, including the National Centre for Artificial Intelligence and Robotics (NCAIR), the Computer Emergency Readiness and Response Team (CERRT), the Nigeria Data Protection Act (NDPA) 2023, the national digital identity programme, interoperable payments, and human capital initiatives such as the 3 Million Technical Talent (3MTT) and Digital Literacy for All (DL4ALL) programmes.

Inuwa cited example with International Federation for Information Processing (IFIP) President, Antony Wong, that called for stronger protection and strategic use of data in the Global South to safeguard indigenous knowledge. He stressed the importance of legal clarity on data ownership as Nigeria’s cultural heritage in medicine, ecology, and art is digitised and incorporated into AI systems. Wong praised Nigeria’s role in the recent World Intellectual Property Organization (WIPO) treaty protecting genetic resources and traditional knowledge.

Delivering his welcome address, the NCS President, Dr. Muhammad Sirajo, said the conference would serve as a platform for IT professionals to address critical issues, including intelligent systems, fintech, sustainable energy, and innovations in agriculture, health, education, and national planning.

“This conference will provide an interdisciplinary platform for researchers, practitioners, and educators to present and discuss recent innovations, trends, and solutions for improving technological systems,” Sirajo said.

The week-long event includes plenary sessions, a doctoral consortium, a youth and entrepreneurship forum, the Fellows Forum, the Annual General Meeting, an IT quiz competition for students, and an induction ceremony for new members. It will conclude with the election of new national executives, a dinner, and an awards night honouring contributions to the ICT sector.

 


Kindly share this post
Continue Reading

E-Business

AfDB Adopts AI to Fast-track Africa’s Development Blueprint

Published

on

Kindly share this post

The African Development Bank (AfDB) is betting big on Artificial Intelligence (AI) as a catalyst for delivering Africa’s ambitious Agenda 2063.

With hands-on training in tools like ChatGPT and Google Gemini, the Bank believes the results could redefine how the continent plans, measures, and delivers its development goals.

Through its Joint Secretariat Support Office, the AfDB has provided technical and financial support to the 5th annual training workshop for African Union member states, focusing on the use of AI to track and implement the second ten-year plan (2024–2033) of Agenda 2063.

The five-day workshop, held in Lusaka, Zambia, was co-organised by the African Union Commission and the African Capacity Building Foundation.

Participants from across the continent rolled up their sleeves for hands-on training with emerging AI platforms like Ailyse, Google AI Studio, and Perplexity.

The goal of Africa’s multilateral development finance institution is to turn complex development data into actionable insights that can drive smarter decisions, faster interventions, and more accountable governance.

AbibuTamu, lead programme co-ordinator at the AfDB, said AI was now an indispensable tool for Africa’s future.

“These tools are not only revolutionizing how data is collected, analysed, and reported, they are also enabling more targeted policy interventions and efficient resource allocation,” Tamu told delegates.

Agenda 2063, dubbed “The Africa We Want,” is the African Union’s 50-year blueprint for inclusive growth and sustainable development. The second 10-year plan prioritises industrialisation, digital transformation, and sustainable livelihoods.

With AI now in the mix, African policymakers can track progress in real-time, spot bottlenecks before they choke projects, and reallocate resources where they are needed most.

The AfDB’s backing underscores a broader strategy of boosting both human and institutional capacity that propels African states to harness the digital revolution.

Beyond technical skills, the Lusaka workshop doubled as a peer-learning platform, with countries sharing real-world success stories on integrating AI into national planning and reporting.

“If Agenda 2063 is Africa’s long-term roadmap, this AI training is about upgrading the continent’s GPS that ensures leaders not only know the destination, but also have the intelligence to navigate every twist and turn on the way,” said Tamu.


Kindly share this post
Continue Reading

E-Business

Firm Shares Tips for Safer Remote Working

Published

on

Kindly share this post

It is holiday season in many parts of the world. These days though, going on holiday does not always mean turning your back on office life – hybrid work cuts both ways.

Today’s widespread connectivity—available at airports, train stations, restaurants, hotels, and most indoor public spaces—makes staying connected easier than ever, with free Wi-Fi in many locations and reliable 4G or 5G coverage elsewhere, helping to facilitate a seamless blend of work and leisure even while on holiday.

This increase in connectivity among travellers has not gone unnoticed by cyber criminals. Kaspersky experts analysed nearly 25,000 free Wi-Fi spots in Paris ahead of the Summer Olympic Games and Paralympic Games. The analysis revealed that almost 25% of these networks had weak or no encryption, making users vulnerable to personal and banking data theft.

Travellers often have their guard down. The unfamiliar surroundings of a new location or a different language can throw up a useful smokescreen for a cyberattack, meaning additional care needs to be taken when logging on. Fortunately, a few smart tools and habits can help you stay protected while enjoying the flexibility of remote work.

Use a VPN for secure connections

A VPN is one of the most effective ways to safeguard users’ online activity, especially when working from unfamiliar locations. By encrypting Internet traffic, a VPN ensures that hackers can’t intercept sensitive data like login credentials or financial details. This is particularly important when accessing work emails or company files on public Wi-Fi, where cybercriminals often lurk.

Switch to an eSIM for reliable, secure mobile data

Another useful digital tool that provides a seamless way to stay connected using local mobile networks with no physical SIM card required is the eSIM. This is a game-changer for international travellers who want to avoid sky-high roaming charges or the hassle of hunting down temporary SIM cards in foreign countries.

With an eSIM, a user can download a local data plan before you even arrive at your destination, ensuring instant connectivity the moment you land. This eliminates the need to rely on unsecured Wi-Fi hotspots, significantly reducing your exposure to cyber threats.

Plus, many eSIM providers allow you to manage multiple profiles on a single device, making it easy to switch between work and personal data plans without juggling multiple phones.

Services like Kaspersky eSIM Store enables users to purchase and activate data plans in advance, track usage and top up as needed, all from a single app.

Enable two-factor authentication (2FA)

When travelling, people often leave devices unattended. To protect against unwanted people logging in, travellers should ensure two-factor authentication (2FA) is enabled on all critical accounts and that passwords are used on all devices.

Final tips for a secure workation

Even with a VPN, eSIM and 2FA in place, your devices still need strong defenses against malware, phishing scams and ransomware. Cybercriminals often target remote workers who may let their guard down while travelling, making real-time protection essential.

Modern antivirus software does more than just scan for viruses, it actively blocks malicious downloads, warns you about phishing attempts and even secures your passwords and financial data.

For the most robust security, consider a solution like Kaspersky Premium, which combines antivirus protection, a VPN and password management into a single, easy-to-use package.

By combining a VPN, eSIM and strong antivirus, you can work from anywhere with confidence, whether you’re sending emails from a poolside or joining a video call from a festival tent.

 


Kindly share this post
Continue Reading

Trending