National Information Technology Development Agency (NITDA), has raised alarm over a new artificial intelligence-powered malware known as “DeepLoad,” warning that the cyber threat is actively targeting Nigerian government agencies, financial institutions, businesses and individuals.

The agency disclosed this in a critical advisory issued through its Computer Emergency Readiness and Response Team (CERRT.NG) and shared via its official X account.

The warning comes amid a growing wave of cyber-attacks targeting Nigerian organisations, including private institutions such as banks and government agencies like the Corporate Affairs Commission (CAC).

According to NITDA, DeepLoad is an AI-enhanced malware strain designed to infiltrate systems, steal sensitive information and evade conventional antivirus detection systems.

“The malware is distributed through a social engineering technique involving fake website error,” the advisory stated.

NITDA explained that the malware spreads through deceptive website prompts that trick users into executing malicious commands on their computers.

“Once executed, DeepLoad silently installs itself, harvests stored credentials and sensitive data from major browsers, and leverages artificial intelligence to evade antivirus detection,” the agency said.

The agency further warned that one of the most dangerous features of the malware is its ability to remain active even after attempted removal.

“Critically, the malware incorporates a hidden WMI-based persistence mechanism capable of reactivating the infection up to three days after apparent removal,” it stated.

NITDA stressed that the severity of the threat requires immediate action from both organisations and individuals across the country.

“Given its severity and confirmed active targeting of Nigerian entities, all organizations and individuals must implement the protective measures outlined in this advisory immediately,” the agency added.

The agency warned that individuals, government institutions, businesses, large organisations and small enterprises are all vulnerable to the rapidly evolving cyber threat posed by DeepLoad.

According to NITDA, a successful DeepLoad infection could grant cybercriminals unauthorised access to bank accounts, mobile money services and payment cards, while also enabling the theft of passwords, documents and sensitive personal information stored on web browsers.

The agency warned that the stolen information could be exploited for identity fraud, allowing criminals to impersonate victims for financial gain.

For organisations, NITDA said infections could trigger operational disruptions requiring complete system isolation and remediation procedures. It added that attacks on government systems could compromise classified networks and pose broader national security risks.

To prevent infections, NITDA advised Nigerians never to paste commands from websites into their computers, noting that legitimate software providers do not request such actions.

The agency also cautioned users against opening suspicious files such as “Chrome Setup” or “Firefox Installer” from USB drives and advised that all external storage devices be scanned with antivirus software before use.

NITDA further recommended enabling two-factor authentication on important accounts and avoiding the storage of banking passwords directly on web browsers.

For organisations, the agency urged companies to immediately sensitise staff about the DeepLoad threat, enable PowerShell Script Block Logging across Windows systems and review browser extensions for unauthorised installations.

The advisory also recommended blocking malicious domains, including holiday-updateservice[.]com, forest-entity[.]cc and hell1-kitty[.]cc, at firewall and DNS levels.

Additionally, organisations were advised to check for hidden WMI Event Subscriptions that could allow the malware to survive standard cleanup procedures.

NITDA said institutions that suspect infections should immediately disconnect affected systems from the internet, change all passwords from clean devices, isolate compromised systems, activate incident response teams and report incidents to the agency within 72 hours as required by law.

The latest warning has added to growing concerns over cyber attacks targeting Nigeria’s financial and digital infrastructure in recent months.

In April, the Nigeria Data Protection Commission (NDPC) warned about coordinated cyber threats targeting Nigeria’s financial systems and critical digital infrastructure, urging organisations to strengthen their data protection architecture.

The warning also followed the commission’s announcement of an investigation into an alleged data breach involving Remita Payment Services, Sterling Bank and other entities.

Similarly, the Corporate Affairs Commission (CAC) temporarily shut down its website between April 17 and April 20, 2026, following reports that about 25 million documents may have been exfiltrated during a suspected cyber attack.

National Social Safety Nets Coordinating Office (NASSCO,) has disclosed that more than 12.3 million Nigerians have so far been linked to the National Social Register through their National Identification Numbers (NINs) as part of efforts to strengthen transparency and credibility in the delivery of social interventions.

Dr. Funmi Olotu, national coordinator of NASSCO, disclosed this on Thursday in Abuja during a high-level stakeholder engagement with local government chairmen themed, “Strengthening Local Government Leadership for Inclusive Development and Social Protection Delivery.”

Olotu said the integration of the National Identification Number into the National Social Register was aimed at improving data integrity, eliminating duplication and ensuring that government interventions reached the right beneficiaries.

According to her, the Federal Government was intensifying efforts to build a more credible and accountable social protection system in line with President Bola Tinubu’s Renewed Hope Agenda.

She said, “To strengthen this foundation, we are integrating the National Identification Number into the Register. This reform enhances data integrity, eliminates duplication, and ensures that interventions reach the right people with precision and credibility.”

The NASSCO boss disclosed that the National Social Register currently covers over 20 million households and more than 77 million individuals across the 36 states and the Federal Capital Territory.

“At the centre of this effort is the National Social Register, a national platform designed to identify and support poor and vulnerable households across the country,” she said.

Providing an update on the exercise, Olotu said significant progress had already been recorded across the federation.

“Across 37 states and 774 Local Government Areas, covering 8,756 wards and 217,777 communities, over 9.7 million household records have been updated, with 12.3 million NINs captured and 11.5 million successfully validated,” she stated.

She stressed that effective social protection could not be driven solely from Abuja, noting that local governments remained critical to successful implementation because of their closeness to communities.

“Local Governments are not merely administrative structures, but institutions of service delivery, closest to the people and essential to translating policy into real outcomes in citizens’ lives,” Olotu said.

She urged local government chairmen to take ownership of the NIN integration process and ensure effective grassroots coordination.

“You are not just stakeholders in this process. You are the drivers of execution. You are closest to the communities, you understand the realities on the ground, and you are uniquely positioned to ensure effective implementation of the NIN integration process,” she added.

Also speaking at the event, Olubunmi Olusanya, permanent secretary, Federal Ministry of Humanitarian Affairs and Poverty Reduction, described the National Social Register as a critical pillar in Nigeria’s poverty reduction and humanitarian response framework.

Olusanya said the ministry was advancing a “One Humanitarian–One Poverty Response System” to harmonise interventions and strengthen coordination across government institutions.

He said, “The National Social Register remains a central pillar of this architecture. It provides a credible and verifiable basis for identifying poor and vulnerable households.”

According to him, the integration of NIN into the register would significantly reduce duplication and improve the reliability of data used for planning and programme delivery.

He warned that millions of vulnerable Nigerians could risk exclusion from government interventions without full NIN integration.

“Without full NIN integration, many of them risk being excluded or unable to benefit from government interventions,” he said.

Olusanya also emphasised the importance of local government authorities in ensuring the credibility and effectiveness of the programme.

“Local Governments are not peripheral to this process, they are central to its success. Indeed, they represent the first line of credibility, verification, and last-mile delivery,” he stated.

The stakeholder engagement brought together local government chairmen, officials of the Association of Local Governments of Nigeria, development partners, civil society organisations and other stakeholders involved in social protection delivery across the country.

The Federal Government has in recent years intensified reforms aimed at strengthening the National Social Register amid concerns over transparency, targeting and accountability in social intervention programmes.

The integration of NIN into the database is expected to improve the accuracy of beneficiary records and enhance the efficiency of poverty alleviation initiatives nationwide.

A large-scale cyberattack has been uncovered in which cybercriminals are stealing users’ email credentials and login information through fake event invitation links.

The campaign, which has been observed across multiple countries including the United States, uses highly convincing social engineering techniques to trick users into believing they are accessing legitimate event pages.

The attack begins with what appears to be a normal event invitation message.

When the user clicks the link, they are first shown a   CAPTCHA- Completely Automated Public Turing test to tell Computers and Humans Apart, creating an illusion of legitimacy.

After passing this step, a professionally designed event page opens, closely resembling a genuine website.

At this stage, users are prompted to enter their email credentials, and in some cases, even one-time passwords (OTPs), which are silently captured by attackers.

Cybersecurity researchers report that the campaign was first identified through analysis conducted by security teams at ANY.RUN.

The investigation revealed dozens of suspicious domains and hundreds of phishing links.

Many of these domains were registered starting from December 2025 and continue to generate new phishing pages at scale, indicating an ongoing and evolving operation.

The primary targets of this attack include sectors such as education, banking, government institutions, technology companies, and healthcare organizations.

These industries rely heavily on email communication and remote access systems, making them highly vulnerable to credential theft.

Even a single compromised login can potentially expose entire organizational networks.

Two main attack techniques have been identified.

In the first method, victims are redirected to a fake Google authentication page where both passwords and OTPs are harvested. In the second method, users are tricked into downloading legitimate remote management tools such as ScreenConnect, ConnectWise, LogMeIn, and similar software.

Once installed, attackers gain full control over the victim’s system under the guise of legitimate administrative tools.

Security analysts have also identified common structural patterns in these phishing pages, including endpoints such as /blocked.html, /favicon.ico, and /Image/ directories.

These consistent patterns make it possible to track and analyze related malicious domains.

In some cases, signs of AI-generated content have also been observed, suggesting that attackers may be using automated tools to rapidly scale their operations.

The attack flow is designed to manipulate user behavior. After entering credentials once, victims are often shown an “incorrect password” message, prompting them to re-enter details.

This results in multiple rounds of credential harvesting, increasing the attackers’ success rate. Once the OTP is entered, it is immediately transmitted to attacker-controlled servers, enabling full account takeover.

Prof. Triveni Singh, Cybersecurity expert and former IPS officer, stated, “Today’s cybercriminals rely more on social engineering than technical exploitation. Breaking user trust has become their most powerful weapon. Even simple messages like event invitations are now being weaponized into serious cyber threats.”

Experts strongly advise users not to click on unknown event invitation links, to always log in through official websites, and never share OTPs under any circumstances.

Organizations are also being urged to strengthen their threat intelligence systems and deploy sandbox analysis tools to detect malicious activity before credentials are compromised.

This campaign highlights a growing trend in cybercrime where attackers are shifting from complex technical hacks to simpler yet highly effective psychological manipulation techniques.

Instead of breaking systems, they are increasingly targeting human behavior and trust.

Security professionals further emphasize that identifying such attacks requires attention to subtle technical indicators.

These include suspicious domain names, irregular HTTPS certificates, and repeated password requests on login pages.

Organizations are also encouraged to implement multi-factor authentication across email systems and thoroughly verify URLs before opening any external links.

In addition, security teams are advised to monitor traffic patterns involving suspicious endpoints such as /blocked.html and /Image/ structures, which have been consistently linked to this phishing campaign. Early detection of such indicators can significantly reduce the risk of large-scale data breaches and financial losses.

The ongoing campaign serves as a reminder that cyber threats are becoming more sophisticated, not necessarily through advanced hacking techniques, but through increasingly convincing deception strategies. Awareness, caution, and strict verification remain the most effective defenses against such attacks.