The National Information Technology Development Agency (NITDA) has raised a cybersecurity alert about DeepLoad, a new AI-powered malware actively targeting Nigerian government agencies, banks, businesses, and individuals.
The agency raised the cybersecurity alarm in an advisory guideline published on its X handle on Wednesday, urging Nigerian organisations to be wary of malware attacks.
This is coming weeks after Nigerian private and public institutions faced alleged unauthorised access and attacks on their information systems, including the websites of organisations such as Remita, Sterling Bank, the Corporate Affairs Commission (CAC), and the Economic and Financial Crimes Commission (EFCC).
Subsequently, the federal government, through the Ministry of Communications, Innovation, and Digital Economy, and NITDA, outlined key pillars to guide the establishment of the Ministerial Advisory Council for Cybersecurity Coordination to address the increasing number of alleged data breaches.
According to the Ministry of Digital Economy, the council would focus on building a coordinated national cyber resilience framework anchored in accountability, intelligence sharing, policy alignment, and collaboration across sectors.
In its guidelines raising concerns about the DeepLoad on Wednesday, NITDA said the malware actively targets Nigerian government agencies, financial institutions, businesses, and individuals, and is distributed through a social engineering technique involving fake website error messages.
According to the agency, the malware instructs victims to paste malicious commands into their computers, potentially harvesting stored credentials and sensitive data from major browsers.
“DeepLoad is a new AI-enhanced malware strain actively targeting Nigerian government agencies, financial institutions, businesses, and individuals.
“The malware is distributed through a social engineering technique involving fake website error messages that instruct victims to paste a malicious command into their computer.
“Once executed, DeepLoad silently installs itself, harvests stored credentials and sensitive data from major browsers, and leverages artificial intelligence to evade antivirus detection,” NITDA stated.
The technology agency further explained that the malware includes a hidden WMI-based persistence mechanism that can reactivate the infection up to 3 days after apparent removal.
“Given its severity and confirmed active targeting of Nigerian entities, all organisations and individuals must implement the protective measures outlined in this advisory immediately,” the agency said.
Impact
According to NITDA, a successful DeepLoad infection can result in unauthorised access to bank accounts, mobile money services, and payment cards; theft of saved passwords, documents, and personal information stored in web browsers;
It said the DeepLoad infection can also lead to identity fraud, enabling criminals to impersonate victims for financial gain; organisational disruption requiring full system isolation and remediation; and the potential compromise of classified government networks, posing a direct risk to national security.
Recommended actions
NITDA further warned public and private companies against the Deepload malware, urging them to strengthen password security and avoid pasting commands directly from websites into computers.
“Never paste commands from a website into your computer; legitimate software never asks for this. Do not open files named ‘Chrome Setup’ or ‘Firefox Installer’ from USB drives; scan all USB devices with antivirus software before use,” the agency said, warning corporate companies of possible cyber attacks.
ALSO READ: NITDA, CAC activate cybersecurity measures amid system concerns
The information technology body also encouraged organisations to enable two-factor authentication on all important accounts, advising them to avoid saving banking passwords in web browsers.
It said public and private institutions must also alert their staff to the DeepLoad AI malware and encourage them to remove unauthorised browser extensions from their computers to prevent cyberattacks from malware infections.
“Alert all staff about DeepLoad, enable PowerShell Script Block Logging on all Windows computers, review and remove unauthorised browser extensions.
“Block malicious domains at firewall/DNS level: holiday-updateservice .com, forest-entityl.cc, and hell-kitty/.Jcc; check for hidden WMI Event Subscriptions that standard cleanup may miss.
“If infection is suspected, disconnect from the internet immediately, change all passwords from a clean device, isolate affected systems, activate your incident response team, and report to NITDA within 72 hours as required by law,” the agency said.
