Overall, in 2025, résumés outnumber vacancies 55% to 45%, driven by global layoffs and an influx of younger candidates. Age distribution among the candidates shows a median seeker age of just 24, with a marked teenager presence.

Jobs found on the dark web are predominantly related to cybercrime or other illegal activities, although some legitimate positions are present as well. Kaspersky findings show a shadow economy where 69% of job seekers did not specify a preferred field, openly signaling they’d take any paid opportunity – from programming to running scams or high-stakes cyber operations. The most in-demand IT roles posted by employers on the dark web reflect a mature criminal ecosystem:

Developers (accounted for 17% of vacancies) create attack tools;
Penetration testers (12%) probe networks for weaknesses;
Money launderers (11%) clean illicit funds through layered transactions;
Carders (6%) steal and monetise payment data;
Traffers (5%) drive victims to phishing sites or infected downloads.

Gender-specific patterns emerged in specialised applications. Female applicants predominantly sought interpersonal roles, including support, call-centre, and technical-assistance positions. Male applicants, by contrast, more frequently targeted technical and financial-crime roles – developers, money mules, or mule handlers.

Salary expectations varied sharply by specialisation. Reverse engineers commanded the highest compensation, averaging over $5,000 monthly, followed by penetration testers at $4,000 monthly and developers at $2,000. Fraudsters tended to receive a fixed percentage of a team’s income. Money launderers average 20%, while carders and traffers earn approximately 30% and 50% of the full income, respectively. These figures reflect a premium on scarce, high-impact skills within the shadow ecosystem.

“The shadow job market is no longer peripheral; it’s absorbing the unemployed, the underage, and the overqualified. Many arrive thinking that the dark web and the legal market are fundamentally alike, rewarding proven skills over diplomas, with the dark web even offering some benefits – like offers landing within 48 hours and no HR interviews. However, not many realise that working on the dark web can lead to prison,” comments Alexandra Fedosimova, Digital Footprint Analyst at Kaspersky.

Young individuals contemplating dark web employment must recognise that short-term earnings carry irreversible legal and reputational consequences. Parents, educators, and the community are urged to report suspicious online solicitations immediately. Children should be shown that there are multiple skill-building and career pathways in legitimate technology sectors, such as cybersecurity, Kaspersky said.

The Kaspersky analysis was based on 2,225 job-related posts – vacancies and resumes – published on dark web forums between January 2023 and June 2025. Some of the forums and resources reviewed may no longer be accessible at the time of publication.

The post Dark web attracts laid-off workers, teenagers, and elite talent appeared first on ProtectionWeb.

“This Cybersecurity Awareness Month, we’re raising awareness around unregulated use of social media platforms in the office,” said Carey van Vlaanderen, Group CEO at ESET Southern Africa. “There are two main risks when it comes to employees using social media at work. The first is sharing sensitive data – like client details, financial figures, and even login credentials – on platforms that weren’t designed with corporate cybersecurity in mind, and the second is being tricked into clicking on malicious links via fraudulent ads or direct messages.”

South Africans are among the most exposed to high-risk and fraudulent financial ads online, according to research by forex broker analysts at BrokerChooser. Each time employees access social platforms on corporate devices, a single click can introduce malware, trigger phishing attacks, or compromise sensitive information. “What starts as an individual mistake can rapidly escalate into a company-wide vulnerability,” says van Vlaanderen.

In 2024, analysts estimated that the average cost of recovering from a data breach in South Africa reached R53-million – up roughly R4-million from the previous year; “The cost of human error can be extremely high. Without reliable safeguards and an understanding of what to look out for, employees face the constant challenge of distinguishing what’s legitimate from what’s not. With AI boosting the social engineering capacity of cybercriminals, this is getting harder and harder to do,” said van Vlaanderen.

Rising security concerns have prompted action from the platforms themselves. Earlier this year, Meta removed more than six million scam-linked WhatsApp accounts globally. Instead of retreating, attackers doubled down – most recently exploiting a glitch in the platform to infiltrate victims’ phones and steal data. This creates a perfect storm: WhatsApp is the go-to tool for workplace communication, with more than 90% of employees across Africa using it daily – surpassing both email and Microsoft Teams.

“These platforms were built for consumers, not corporations – so they don’t offer the same level of security and privacy protection that purpose-designed systems guarantee. Operating outside formal safety controls, risky cyber activity can easily bypass protections and go unnoticed,” said van Vlaanderen.

“Even just sharing details about work, clients, and colleagues online can be risky, since it provides cybercriminals with all the information they need to impersonate managers in business phishing emails. From employee through to CEO, everyone needs to remain vigilant and be thoughtful about what they are posting online,” said van Vlaanderen. “These are all things that can be included in a business’s social media policy.”

From a business perspective, the biggest vulnerability isn’t unsecure platforms – it’s people; “Equipping your team with the tools to identify risks on their own is critical to keeping up with rapidly evolving threats. Speak to your provider about cybersecurity awareness training that can help build practical, real-world skills through immersive, scenario-based programmes,” said van Vlaanderen. “This kind of investment not only protects your assets but also strengthens the resilience of the entire corporation.”

The post Employees’ social media habits create costly security gaps for SA businesses appeared first on ProtectionWeb.

The INTERPOL-coordinated sweep, codenamed Operation Serengeti 2.0, ran from June to August 2025 and brought together investigators from 18 African nations alongside the United Kingdom. In total, authorities recovered USD 97.4m (£76.7m), dismantled over 11,000 malicious infrastructures and targeted crimes ranging from ransomware to business email compromise (BEC).

The operation followed warnings from INTERPOL’s Africa Cyberthreat Assessment Report, which highlighted the region’s exposure to high-impact online threats.

Large-Scale Fraud and Crypto Crackdowns

Authorities in Angola shut down 25 illegal cryptocurrency mining centres run by 60 Chinese nationals. The crackdown uncovered 45 illicit power stations and equipment worth more than USD 37m, now earmarked by the government to bolster electricity distribution in vulnerable communities.

In Zambia, police dismantled an investment fraud scheme that tricked some 65,000 victims into investing in bogus cryptocurrency ventures. Losses are estimated at USD 300m. Investigators seized domains, mobile numbers and bank accounts, while 15 arrests were made. In a separate case, Zambian authorities uncovered a scam centre linked to human trafficking, seizing 372 forged passports.

Meanwhile, officers in Côte d’Ivoire arrested the ringleader of a transnational inheritance scam operating out of Germany. The fraud, which duped victims into paying fees to claim fictitious inheritances, caused losses of around USD 1.6m. Items seized included electronics, jewellery, vehicles and cash.

Training, Intelligence Sharing and Prevention

The operation was bolstered by intelligence from private sector partners including Kaspersky, Trend Micro and TRM Labs, who provided data on suspicious IPs, domains and command-and-control servers. Ahead of the crackdown, investigators also underwent intensive training in cryptocurrency tracing, open-source intelligence and ransomware analysis.

INTERPOL Secretary General Valdecy Urquiza said:

“Each INTERPOL-coordinated operation builds on the last, deepening cooperation, increasing information sharing and developing investigative skills across member countries. With more contributions and shared expertise, the results keep growing in scale and impact.”

The initiative also linked with the International Cyber Offender Prevention Network (InterCOP), a consortium of 36 countries led by the Netherlands, which works to detect and deter cybercriminal activity before it escalates.

Global Cooperation

Operation Serengeti 2.0 formed part of the African Joint Operation against Cybercrime, supported by the UK’s Foreign, Commonwealth and Development Office. Participating countries included Nigeria, Kenya, South Africa, Ghana, Tanzania, and Zimbabwe, alongside European partners.

The results highlight both the scale of cybercrime across Africa and the growing effectiveness of cross-border policing. Authorities say further arrests and asset seizures are likely as investigations continue into international collaborators.

The post African cybercrime networks dismantled in major INTERPOL operation appeared first on ProtectionWeb.

Why do we call it “smart”?

Smart home systems integrate various devices, creating a “living” environment, enabling seamless interaction between gadgets and users. Usually, it has a central hub or controller, which acts as the brain of the smart home. Smart home systems can include a wide variety of devices and appliances such as cameras, sensors, actuators and multiple household gadgets such as fridges, toasters, washing machines and vacuum cleaners. These devices connect with each other and other systems via the Internet.

Users can choose between different options when interacting with their smart home:

• Mobile apps that allow users to control devices, set schedules, and receive notifications even outside the house
• Voice assistants, which enable voice commands to control devices
• Web Portals and online dashboards that provide access to device settings and monitoring after logging in to the user’s account.

Comfort and ease of use are the main advantages of a smart home system. Users can set specific times for devices to perform actions, for example, turning on lights at sunset. Devices can also be programmed to respond to specific events, such as turning on the thermostat when the user arrives home. Even TVs with built-in AI technology, which can help you to discover dishes in shows as they appear on screen, find the recipe, and then compare the products needed for its preparation with those that are in your fridge and make a shopping list doesn’t sound like a fantasy anymore.

Despite the advantages that a smart home system offers, its Achilles’ heel is the Internet connection. Connectivity of all devices to a local Wi-Fi network as well as the need to log into personal accounts makes intelligent gadgets potentially vulnerable to hacking. There are already examples when attackers gained unauthorised access to Ecovacs robot vacuums to spy on their owners and disturb them by making loud noises and uncontrolled moves. Even an Internet-connected mattress system in theory can be hacked, making the gadget potentially unsafe to use.

The vacuum cleaner is watching you

The idea that the regular household items surrounding you every day might be sharing personal data, overhearing, or even watching you, sounds terrifying. However, there is no need to stop using your favourite gadgets. Though examples of smart home device attacks are still rare, basic security rules are essential to safely enjoy the benefits of smart technology, preventing hackers from using them against you.

1. Secure your Wi-Fi network. It’s highly recommended to change the system password that many Wi-Fi routers have by default to a more complex and secure one. Here are some tips on how to create stronger passwords.
2. Monitor your network regularly. Look out for any suspicious activity on your local network or even consider using specific monitoring tools like Kaspersky Wi-Fi Security Check, which alerts you if Wi-Fi security settings are weak or if there are open ports that could allow unauthorised access to your Wi-Fi or smart home devices and Smart Home Monitor, which notifies you when a new device joins your Wi-Fi network so you can disconnect it.
3. Track your device’s activity. Any device’s unusual behaviour might be a signal that somebody has access to it. If you notice suspicious activity it’s recommended to change your account password (if you are logged in on the device) and check your local network traffic.
4. Review the settings regularly. Less is more. Disable any unnecessary features or services on your device that could pose a risk to your privacy or security. For example, you can disable access to a device’s camera and microphone if you are not currently using these functions.
5. Make rational choices. The prospect of using as many smart devices as possible seems very tempting, but remember that every new gadget increases the potential risk to your security, so choose carefully and opt for responsible manufacturers.

The post My house is my castle: Kaspersky explains how to protect smart home devices appeared first on ProtectionWeb.

History Of Deepfakes

The term “deepfake” burst into public consciousness in late 2017 and originated from Reddit, where a user of the same name shared manipulated pornographic videos, often of celebrities, by superimposing their faces onto existing footage. This initial, notorious application combined “deep learning” algorithms with “fake” media, and the release of underlying open-source code made the creation process available to everyone, allowing individuals with moderate technical skills to produce their own versions.

Since then, the technology has evolved at a breakneck pace, moving from these early, often discernible, manipulations to increasingly sophisticated and convincing fakes capable of being used for political disinformation, financial scams, and even live impersonations, marking a swift and concerning progression from niche internet phenomenon to a mainstream societal challenge.

Case Studies: The Real-World Impact of AI Impersonation

High-profile cases have demonstrated the devastating potential of this technology. The following two case studies served as the source of inspiration that drove the research MWR CyberSec did into this subject.

Case Study 1: The Elon Musk Deepfake Scams in South Africa

In South Africa, a series of sophisticated deepfake scams emerged, leveraging the likeness of Elon Musk and other prominent local billionaires like Johann Rupert and Patrice Motsepe. Scammers created convincing videos where these personalities appeared to endorse AI-powered cryptocurrency trading platforms. These deepfakes promised outlandish returns – for instance, turning a R4,700 investment into R30,000 in a single day.

The deepfake videos were remarkably well-produced, with “Musk’s” voice even mimicking local accents to enhance credibility. These videos circulated widely on social media, with some attracting hundreds of thousands of views. The consequence was substantial financial loss for numerous investors. In one documented instance, an individual invested and lost R5 million to one such scheme. While precise overall numbers are hard to ascertain, the widespread nature of these campaigns suggests that over 150 individuals could have fallen victim to this one specific campaign.

The following two videos show how one such deepfake scheme was created using a real existing interview of Elon Musk on Wall Street Journal and lip syncing it to a different audio source.

This case highlights not only the commercial impact through direct financial losses but also the significant social impact, as it erodes public trust and preys on the familiarity and authority of well-known figures.

Case Study 2: Arup’s $25 Million Lesson in Live Deepfake Deception

In a chilling demonstration of how deepfakes can infiltrate corporate settings, a multinational engineering firm called Arup fell victim to a $25 million scam in 2024.

A finance employee based in the company’s Hong Kong office received an email, purportedly from the UK-based Chief Financial Officer (CFO), requesting urgent and confidential fund transfers.

Initially, the employee was sceptical about the email, however, he was then invited to a video conference call. On this call, attackers convincingly impersonating the CFO and other senior executives (whose likenesses and voices were deepfaked in real-time) assured the employee that the instructions were legitimate and allayed concerns. Convinced by what appeared to be a legitimate, multi-participant video meeting with trusted colleagues, the employee authorised transfers amounting to approximately $25 million (HKD 200 million) to accounts controlled by the fraudsters.

This incident was a stark wake-up call, proving that live, real-time deepfakes are now sophisticated enough to deceive professionals in a business environment. The attack resulted in massive financial loss and underscored the potential for severe reputational damage to organisations that fall prey to such schemes. It also highlighted the psychological manipulation involved, as the live video interaction effectively overrode the employee’s initial skepticism.

How These Things Actually Work: The Technology Behind the Deception

Deepfakes leverage sophisticated AI to superimpose existing images and videos onto source images or videos (for video deepfakes) or to synthesise a target person’s voice (for audio deepfakes). Here is a general overview of the process that goes into making a deepfake:

Phase 1: Data Collection

For both video and audio deepfakes, source material is required for the target person that will be deepfaked. Typically, a significant amount of high-quality video, images and audio is required of the target person in order to train AI models to perform the deepfake.

To perform training, processing has to be performed on the source data such as transcribing audio, cropping images, feature extraction, and various other actions that enhance the training process.

Phase 2: Model Training (Teaching the AI)

This is the most computationally intensive phase of the process. The source material gathered by the attacker is fed to a model and training is performed. For video content, this involves learning the unique facial features, expressions, and nuances that make up the target person. For audio training, it involves learning the characteristics of the target’s voice, including pitch, timbre, intonation and rhythm.

Phase 3: Generation & Refinement (Creating the Fake)

Once the model has been trained, a deepfake can be produced. This can take the form of pre-recorded video or a live performance deepfake. The trained model from phase 2 generates the target person’s face or voice based on the input it receives from either a driving video or webcam and microphone.

For pre-recorded content, post processing and refinement could also be performed to make the deepfake look and sound more realistic. Lip syncing could be performed or visual artifacts might be edited or hidden with overlays.

Pre-trained models

Various pre-trained models are also available that can be used to produce deepfake content. These tools completely eliminate the need to perform vast source material gathering or training a model for millions of iterations, but rather allows a user to upload a short audio clip or even a single picture in order to start the deepfake process. The following video from research done by Bytedance shows just how advanced these pre-trained models can be.

It should be noted that the tool mentioned above was not publicly available at the time of writing due to ethical concerns by the developers (Good!). It does however demonstrate that with the rapid progression of AI tools in our modern age, the limitations for creating deepfakes are becoming less and less of a barrier to entry for attackers.

Technical Shortcomings Seen In The Practical Application Of Deepfakes

During MWR’s own attempts at recreating these techniques, some technical shortcomings were encountered that could help identify poorly made deepfakes.

Audio Deepfake Shortcomings

• Unnatural Cadence and Pace: AI models can struggle with rhythm. Listen for speech that is unnaturally fast or slow, as this can cause the AI to generate noticeable glitches or distortions.
• Volume Changes: Rapid volume changes from loud to quiet or vice versa can often lead to audio artifacting (that robotic sounding voice) being produced by the model.
• Whispers: Whispering lacks strong vocal cord vibration (pitch), which is a key feature that audio models rely on. Consequently, cloned whispers often sound distorted, breathy, or may have bizarre tonal inclinations.
• Context is King: The most powerful detection tool is your own familiarity with the person supposedly speaking. If you know them well, you may notice that their diction, tone, or emotional inflection is “off”. Trust your intuition if the voice sounds like them, but the way they are speaking doesn’t.
• Vocal Range Mismatch: Real-time voice changers are particularly vulnerable when there’s a significant difference between the input and target voices. For example, if someone with a naturally high-pitched voice attempts to clone a very deep, low-pitched voice in real-time, the output may sound strained, tinny, or unstable. This doesn’t help that much in detecting these as an attacker would likely pick a target that more closely resembles their own voice.

The audio samples below demonstrates some of the shortcomings:

Video Deepfake Shortcomings

• Masks: A deepfake model needs to constantly detect a face in the source video to overlay a target face onto it. If this detection is interrupted—perhaps by a hand passing in front of the face or gestures that the source video didn’t cover (think sticking your tongue out), or poor lighting, the “mask” can break. The results are often jarring and obvious, ranging from features being incorrectly mapped to the fake face momentarily vanishing altogether.
• Unnaturally Smooth Skin: The deepfake generation process often involves compressing and then reconstructing facial features. This can lead to a loss of fine detail. Look for skin that appears unnaturally smooth, almost like a digital airbrush has been applied. Details like pores, wrinkles, fine hairs, or even stubble may be smoothed over or absent entirely, giving the person a doll-like appearance.
• Irregular Gestures and Behaviour: This is another context-based clue. We all have unique mannerisms, head tilts, and hand gestures that accompany our speech. A deepfake may replicate a face perfectly, but if the gestures or expressions don’t match the person you know, it’s a major red flag. If a normally animated friend is suddenly stiff and inexpressive on a video call, or vice versa, it could indicate that you’re watching a digital puppet, not a real person.

The video below demonstrates some of these shortcomings in an exaggerated manner:

Mitigations and Staying Vigilant: What Can Be Done?

The U.S. Department of Homeland Security (DHS), in its report “Increasing Threats of Deepfake Identities” emphasises that the threat of deepfakes comes not just from the technology itself, but from our natural inclination to believe what we see and hear. Even less sophisticated deepfakes can be effective in spreading misinformation.

The DHS report outlines that there is no single, universal solution to the deepfake problem. Instead, a multi-pronged approach is necessary, encompassing the following phases of a deepfake attack:

1. Technological Innovation:

• Developing and improving deepfake detection technologies. This is an ongoing “cat and mouse” game as generation techniques become more advanced.
• Exploring digital watermarking or authentication technologies that can help verify the authenticity of media.
• This phase is largely dependent on developers and organisations that have to consider the ethical implications of what they are developing but also how these safety measures could be added.

2. Education and Awareness:

• Critical Evaluation of Media: Individuals need to be educated to critically evaluate online content, especially if it seems sensational or too good to be true. Look for inconsistencies in media, including unnatural features visible artifacting and what some call “uncanny valley”.
• Source Verification: Always try to verify the source of information. Is it from a reputable news outlet or official channel? Be wary of content shared widely on social media without clear attribution.
• Awareness of Impersonation Tactics: Understand that AI can be used to impersonate executives, colleagues, or public figures. For sensitive requests, especially those involving financial transactions or confidential information, use out-of-band verification (e.g. a phone call to a known number, or an in-person check if possible) before acting.

3. Regulation and Policy:

• Developing legal frameworks and regulations to address the malicious use of deepfakes, including issues of consent, fraud, and defamation.

4. Public-Private Cooperation:

• Encouraging collaboration between government agencies, research institutions, and private sector companies (including social media platforms and tech developers) to share information, develop standards, and implement safeguards.

Individual Precautions:

The DHS highlights different phases and threat actors, however, the core advice for individuals to protect themselves includes:

• Be Skeptical: Approach unsolicited communications or unusual requests with caution, even if they appear to come from a known person.
• Verify Identity: If you receive a suspicious video call or audio message, try to verify the person’s identity through a different communication channel that you know is legitimate. Ask questions that only the real person would know.
• Look for Tell-Tale Signs: While deepfakes are getting better, some artifacts may still be present:
  • Unnatural eye movements or lack of blinking.
  • Awkward facial expressions or lip-syncing.
  • Blurring or distortion, especially where the face meets the hair or neck.
  • Strange lighting or skin tones.
  • Audio that sounds robotic, has an unusual cadence, or lacks emotional depth.
• Report Suspected Deepfakes: If you encounter a malicious deepfake, report it to the platform where you saw it and, if appropriate, to law enforcement.

AI-driven impersonation is a rapidly evolving threat that poses significant risks across personal, commercial, and societal domains. As the technology becomes more accessible and sophisticated, the potential for misuse grows. By understanding how these deepfakes are created, learning from real-world incidents, and adopting robust mitigation strategies that combine technological solutions with critical human awareness, we can better defend ourselves against this new wave of digital deception. Staying informed and vigilant is our first and most crucial line of defence.

The post The alarming rise of AI impersonation: When seeing and hearing isn’t believing appeared first on ProtectionWeb.

Two-thirds of the Organization’s African member countries surveyed said that cyber-related crimes accounted for a medium-to-high share of all crimes, rising to 30 per cent in Western and Eastern Africa.

Online scams, particularly through phishing, were the most frequently reported cybercrimes in Africa, while ransomware, business email compromise (BEC) and digital sextortion also remain widespread.

Neal Jetton, INTERPOL Cybercrime Director, said:

“This fourth edition of the INTERPOL African Cyberthreat Assessment provides a vital snapshot of the current situation, informed by operational intelligence, extensive law enforcement engagement and strategic private-sector collaboration. It paints a clear picture of a threat landscape in flux, with emerging dangers like AI-driven fraud that demand urgent attention. No single agency or country can face these challenges alone.”

Ambassador Jalel Chelba, Acting Executive Director of AFRIPOL, said:

“Cybersecurity is not merely a technical issue; it has become a fundamental pillar of stability, peace, and sustainable development in Africa. It directly concerns the digital sovereignty of states, the resilience of our institutions, citizen trust and the proper functioning of our economies.”

Africa’s top cyberthreats

In the past year, suspected scam notifications rose by up to 3,000 per cent in some African countries, according to data from Kaspersky – one of several private sector partners that works with INTERPOL’s cybercrime directorate.

Ransomware detections in Africa also rose in 2024, with South Africa and Egypt suffering the highest number, at 17,849 and 12,281 detections respectively according to data from Trend Micro, followed by other highly digitized economies such as Nigeria (3,459) and Kenya (3,030).

Incidents included attacks on critical infrastructure, such as a breach at Kenya’s Urban Roads Authority (KURA), and on government databases, such as hacks of Nigeria’s National Bureau of Statistics (NBS).

BEC-related incidents also rose significantly, with 11 African nations accounting for the majority of BEC activity originating on the continent. In West Africa, BEC fraud has driven highly organized, multi-million-dollar criminal enterprises, such as transnational syndicate Black Axe.

Sixty per cent of African member countries reported an increase in reports of digital sextortion, where threat actors use sexually explicit images to blackmail their targets. The images can be authentic – shared voluntarily or obtained through coercion or deception – or they can be generated by artificial intelligence.

Law enforcement challenges

Cybercrime continues to outpace the legal systems designed to stop it, according to African law enforcement. Seventy-five per cent of countries surveyed said their legal frameworks and prosecution capacity needed improvement.

At the same time, countries also reported struggling to enforce the existing laws on cybercrime, with 95 per cent of respondents reported inadequate training, resource constraints and a lack of access to specialized tools.

Despite rising caseloads, most African member countries surveyed still lack essential IT infrastructure to combat cybercrime. Just 30 per cent of countries reported having an incident reporting system, 29 per cent a digital evidence repository and 19 per cent a cyberthreat intelligence database.

While cybercrime routinely crosses national borders, 86 per cent of African member countries surveyed said their international cooperation capacity needs improvement due to slow, formal processes, a lack of operational networks, and limited access to platforms and foreign-hosted data.

Cybercrime investigations increasingly rely on cooperation from private sector partners, yet 89 per cent of African countries said their cooperation with the private sector needed ‘significant’ or ‘some’ improvement due to unclear channels for engagement, low institutional readiness and other barriers.

Strengthening cyber resilience

Nevertheless, the INTERPOL report also details positive steps that many African member countries have made to strengthen their cyber resilience.

Several African countries advanced their legal frameworks, harmonizing cybersecurity laws with international standards. Many countries also enhanced their cybercrime response capabilities, investing in specialized units and digital forensics infrastructure.

This increased operational capacity was demonstrated in two high-impact international cybercrime operations coordinated by INTERPOL – Operation Serengeti and Operation Red Card – which collectively led to more than 1,000 arrests and the dismantling of hundreds of thousands of malicious networks.

To further improve Africa’s cybercrime response capabilities, the INTERPOL report proposes six strategic recommendations, including improving regional and international cooperation, expanding prevention and public awareness, and leveraging emerging technologies.

The post New INTERPOL report warns of sharp rise in African cybercrime appeared first on ProtectionWeb.

According to NETSCOUT, the DieNet group announced itself on 7 March 2025, via a now-banned Telegram channel, and its targets span transportation, energy, medical systems and digital commerce.

DieNet has leveraged DDoS-as-a-service infrastructure, commonly shared with other groups such as OverFlame and DenBots Proof, to launch ideologically driven attacks against the US, Iraq, Israel, Sweden, and Egypt to date. And, although the group claims some success, it is often difficult to validate whether the attacks have had any impact on the targets. 

“However, their scale and frequency – often allegedly averaging one attack per day – expose the ease with which new actors can exploit widely accessible rented infrastructure to launch their own DDoS campaigns,” says Bryan Hamman, regional director: Africa at NETSCOUT, “and this is something that should raise concern across Africa.” 

“Local organisations are increasingly being targeted by DDoS and other cyberattacks, particularly in sectors like telecoms, government and financial services. The rapid mobilisation and global scale of groups like DieNet highlight just how easily bad actors can take advantage of available tools to disrupt services on any continent, including ours.”

Since its emergence earlier this year, DieNet has gained visibility through other known active threat actor organisations, such as Mr. Hamza, Sylhet Gang-SG and LazaGrad Hack. Its attack methods are characterised by a mixture of vectors such as TCP RST, DNS amplification, TCP Syn and NTP amplification. The chosen vectors and attack patterns vary between targets.

Despite DieNet’s claims, NETSCOUT’s analysis reveals no evidence of a proprietary botnet. Instead, the group appears to rely on the same attack infrastructure used by other threat actors, reinforcing the risk posed by DDoS-as-a-service ecosystems.

The tactics used by DieNet demonstrate how easily malicious actors can launch attacks using widely accessible platforms, without needing large-scale technical infrastructure, comments Hamman.

“What’s clear is that organisations in Africa can no longer afford a reactive approach,” he adds. “Early detection, real-time visibility and proactive mitigation are critical to staying one step ahead of cyber criminals.”

The post NETSCOUT warns of new hacktivist threat posing global risks, from the US, Middle East, Africa and beyond appeared first on ProtectionWeb.

The charges against Erasmus relate to a 2023 incident in which he and co-accused Felix Unathi Pupu (43), both former employees of Ecentric, installed software on the company’s systems that enabled unauthorized remote access. This access was later exploited in an attempted ransomware scheme that included multiple extortion attempts and led to significant data breaches.

Erasmus was convicted on a wide range of charges, including:

• One count of contravening section 12 of the Cybercrimes Act No. 19 of 2020

• One count of theft of data

• Two counts of attempted cyber extortion

• Four counts of cyber fraud

• Four counts of unlawful access to a computer system

• Three counts involving unlawful use of software or hardware tools

• Two counts of unlawful interference with network or data

• One count of interference with a data storage medium

• One count of password resetting

• One count of unlawful access

• One count of trespassing

According to court documents, the software installed by the accused allowed a third party to breach Ecentric’s IT infrastructure. On 14 November 2023, a ransom demand was made to Ecentric’s CEO, requesting payment of US$534,260 within 16 hours, with the threat that company data would be leaked publicly—including to competitors and regulators—within 30 hours. When the initial demand was not met, a second ransom of US$1 million was issued on 30 November 2023.

Ecentric did not comply with either demand. However, four of its retail clients sustained financial losses totalling R794,808.51 as a result of the cyberattack.

Erasmus has been in custody since 14 December 2023. His co-accused, Felix Pupu, remains in custody and is scheduled to appear in court on 30 June 2025 for plea and sentencing.

As part of the conditions tied to the suspended portion of his sentence, Erasmus must not commit any further offences relating to fraud, cybercrime, or trespassing during the five-year suspension period. A violation would lead to the activation of the suspended sentence.

The court also declared Erasmus unfit to possess a firearm.

This case marks a significant application of South Africa’s Cybercrimes Act and highlights the growing focus on criminal accountability for cybersecurity breaches involving insider threats.

Ecentric welcomed the court’s decision, confirming Erasmus’s conviction and sentencing. Digital forensics firm Cyanre, which assisted in the investigation, praised the outcome, calling it a milestone in South Africa’s fight against cybercrime. The company lauded the collaboration between law enforcement and legal experts, highlighting the success as a testament to the Cyber Crimes Act’s effectiveness.

The post Landmark cybercrime conviction: Former IT employee sentenced to eight years for fraud and extortion plot appeared first on ProtectionWeb.

The analysed attack attempts were examples of business email compromise (BEC) attacks. As a rule, such attacks are made on behalf of a management representative of a compromised firm. Importantly, in all analysed cases the senders were fake – the real addresses from where the emails came had nothing in common with the displayed sender names. These tricks were used to persuade the victims that the emails were legitimate.

Some incidents involved emails that imitated correspondence between the company’s CEO and an alleged contractor law firm, urging the financial department to pay the attached fake invoice. The fake correspondence with the CEO of a victim company was used as “proof” that the request for payment was legitimate. In this attack the name of the fictional partner company was indicated only in the name of the sender field, and a real email address was different and changed from email to email.

Other incidents featured similar emails that mimicked communications between the CEO and contractor companies to request urgent payment for a fake invoice, but this time the invoice itself was not attached.

“This attack stands out for its meticulous attention to detail and exploitation of trusted relationships. By fabricating convincing email threads and impersonating high-level executives, attackers are banking on employees’ reluctance to question seemingly authentic requests. Companies must prioritise employee training and robust email verification systems to counter these evolving threats,” commented Anna Lazaricheva, spam analyst at Kaspersky.

In order to avoid becoming a victim of fraudulent messages and specifically business email compromise attacks, Kaspersky experts advise the following:

• Check the sender’s email address and do not rely on the displayed name of the sender, as actual email addresses may have nothing in common with the companies and people who are displayed to have sent the email.
• Only open emails and click links if you are sure you can trust the sender; make sure that the sender’s address is legitimate.
• When a sender is legitimate, but the content of the message seems strange, it is worth checking with the sender via an alternative means of communication.
• Check the spelling of a website’s URL if you suspect you are faced with a phishing page. The URL may contain mistakes that are hard to spot at first glance, such as a 1 instead of I or 0 instead of O.
• Use a proven cybersecurity solution such as Kaspersky Next and Kaspersky Premium when surfing the web.

The post A targeted attack mimics communication from company CEO to steal funds appeared first on ProtectionWeb.

A recent paper titled “Personhood Credentials: Artificial Intelligence and the Value of Privacy-Preserving Tools to Distinguish Who is Real Online” introduces the concept of personhood credentials (PHCs). A PHC enables an individual to prove their human status to online services, without revealing personal information and without necessarily relying on biometric data. PHCs can be issued by various trusted entities, including governments, and are designed to be both local and global in scope. The use of PHC, therefore, aims to balance the need for online anonymity with the necessity of establishing trust.

The paper highlights two critical AI-driven trends that exacerbate online deception:​

1. Indistinguishability: AI’s ability to generate human-like content, create realistic avatars, and perform actions that mimic human behaviour makes it difficult to differentiate between genuine users and AI entities.​
2. Scalability: The cost-effectiveness and accessibility of AI technologies allow malicious actors to deploy deceptive operations on a massive scale, amplifying their impact.​

One prominent example of AI-powered deception at scale is the use of deepfake technology in social engineering scams. In a well-publicized case, fraudsters used AI-generated voice cloning to mimic the CEO of a company and instructed an employee to transfer large sums of money to a “trusted partner.” Because the voice sounded convincingly real, the employee complied – resulting in a significant financial loss. What makes this particularly alarming is that such technology is becoming more affordable and easier to use, enabling cybercriminals to replicate this kind of attack across multiple organizations with minimal resources.

Compounding the issue, traditional countermeasures, such as CAPTCHAs, are becoming increasingly ineffective against sophisticated AI systems. Moreover, stringent identity verification processes often infringe upon user privacy, creating a conundrum for online platforms striving to maintain both security and user trust. PHCs providing a means for users to signal their authenticity without sacrificing anonymity.

In the African context, PHCs could be transformative. Individuals across the continent face challenges related to identity verification, due to lack of proper documentation and infrastructural inefficiencies. South Africans, for example, require visas for 96 countries because of a lack of trust in the country’s passports. Such obstacles hinder access to essential services, economic participation, and cross-border interactions. By adopting PHCs, African nations can enable their citizens to engage securely in the global digital economy.

Establishing trusted digital identities is of critical importance. According to Carrie Peter, Managing Director of Impression Signatures and Advocacy Committee Vice-Chair at the Cloud Signature Consortium: “In an era where AI blurs the lines between human and machine, ensuring that individuals can securely and privately assert their personhood online is not just a technical necessity but a fundamental human right.”​

The path forward requires a concerted effort to develop PHCs-systems that are privacy-preserving, user-centric, and cross-border interoperable. “This way we can create a digital environment where trust is restored, and individuals are empowered to navigate the online world with confidence. As AI continues to evolve, the imperative to distinguish between human and artificial agents will only grow more pressing,” concludes Peter. “PHCs represent a vital step towards safeguarding human identity in the digital age, ensuring that the internet remains a space for genuine human connection, safe interactions and mutually beneficial global recognition.”

The post Safeguarding human identity in the age of AI appeared first on ProtectionWeb.