Cybersecurity experts have identified a new threat. It is called DeepLoad. This AI-powered malware is now attacking Nigerian government agencies and banks.
The Nigeria Computer Emergency Response Team (ngCERT) issued a high-risk advisory on April 30, 2026. This malware targets Windows systems specifically.
The attack uses a method known as ClickFix. It shows fake website error messages. These messages tell victims to paste a command into their computer.
If a user follows these steps, the malware installs itself and then starts stealing passwords and bank details from web browsers like Google Chrome.
DeepLoad is dangerous because it uses artificial intelligence and this helps the code change its shape. Because of this, many antivirus programs cannot see it.
Furthermore, the malware uses a hidden persistence trick. It can reactivate itself three days after a user thinks they have deleted it from the system.
Consequently, this poses a massive risk to national security. Successful infections could lead to the theft of classified government documents.
Meanwhile, individuals are also at risk. The malware can steal access to mobile money services and payment cards for financial gain.
AI Evasion and Persistent Threat Mechanisms
The National Information Technology Development Agency (NITDA) stated that the malware targets critical infrastructure. This includes banks and public institutions.
DeepLoad can also spread through USB drives. It hides inside files with names like “Chrome Setup” or “Firefox Installer” to trick the user.
The agency explained that users should “never paste commands from browser prompts into Run or PowerShell” as legitimate software never asks for this.
Furthermore, the malware installs rogue browser extensions. These extensions can watch everything a person does online in real-time.
Security researchers at The Hacker News stated that the malware uses WMI event subscriptions which makes cleanup very difficult for standard tools.
Additionally, the malware is alleged to be highly effective at lateral movement. This means it can jump from one computer to others on the same network.
Organisations should block domains like “holiday-updateservice[.]com, forest-entity[.]cc, and hell1-kitty[.]cc” at the firewall level immediately.
Mandatory Reporting and Protection Guidelines
If a person suspects an infection, they must act fast and disconnect from the internet and change all passwords using a different device.
Furthermore, Nigerian law requires organisations to report any breach. They must contact NITDA within 72 hours of finding the malware on their system.
Technical teams should enable PowerShell Script Block Logging. This helps to track if any malicious commands have been run on company computers.
Meanwhile, individual citizens should use two-factor authentication. They should also avoid saving banking passwords directly in their web browsers.
Experts advised that all USB devices must be scanned before use. Do not open any file that looks like a browser installer from an unknown drive.
The action to secure these systems is vital for economic stability. A single breach could lead to widespread identity fraud across the country.
Consequently, the government is working to block the supporting infrastructure of the hackers. This is to stop the data from being sent out of Nigeria.
Rate, Like 👍, Comment 💬, Share this article, Follow us on our social media handles, and Submit your own story to get featured and earn rewards!
WhatsApp Channel
Telegram Channel
