Artificial intelligence is enabling 55 per cent of reported cybercrimes across Africa making attacks faster, more scalable, and increasingly difficult for victims and platforms to detect, according to INTERPOL’s African Cyberthreat Assessment Report 2026.
With more than 1.1 billion mobile subscribers recorded in 2025, Africa’s digital transformation is expanding rapidly.
However, cybercrime legislation is fragmented and AI readiness in law enforcement agencies remains alarmingly low.
The 40-page report draws on survey data from 36 African member countries and highlights a defining shift: cyber-criminality has evolved from isolated incidents into an industrialized, borderless ecosystem.
East Africa emerged as a hub of mobile money fraud and infrastructure-targeted ransomware. Kenya recorded more than 46,786 DDoS attacks in the first half of 2025 targeting telecoms, 14 and was included in SOCRadar’s top phishing detection in September 2025.
In 2025, SIM swap fraud surged by 327 per cent in Kenya, with more than 123,000 fraudulent SIMs issued and an estimated USD 3.8 million drained from mobile wallets.
Tanzania and Rwanda reported similar patterns, with telecom providers struggling to implement real-time biometric verification. Ethiopia ranked fifth across the entire continent in vulnerability detections by Shadowserver, while Seychelles faced a targeted breach of its central bank’s customer data, indicating that even small, high-income nations are not immune.
The region’s rapid digital adoption has outpaced its ability to secure it. Kenya and Tanzania made strides in legal reform – Kenya’s Computer Misuse and Cybercrimes (Amendment) Bill 202418 specifically targets SIM swaps and scam calls. The absence of a unified regional cybercrime response mechanism has allowed criminal networks to exploit jurisdictional boundaries between nations.
Ransomware in 2025 evolved from a tool of financial extortion into a mechanism of systemic disruption, with threat actors increasingly targeting public services and critical infrastructure to maximize leverage. The most significant incidents were South Africa accounted for 92 per cent of all ransomware detections in Africa, according to TrendAI data, with incidents affecting key public institutions such as the suspected attack against the South African Weather Service (SAWS) in January 2025.
The incident resulted in the corruption of critical meteorological data systems, leading to disruptions in aviation routing and maritime navigation services. Similarly, in August 2025, Nigeria’s Customs Service was targeted by a ransomware variant28 that paralyzed cargo clearance operations at the country’s major ports, resulting in an estimated USD 18 million in storage fees and significant delays in import timelines.
Data breaches in 2025 were not isolated events; they were the foundational layer upon which nearly every other major cybercrime vector was built.
While ranked third in reported incidence in the INTERPOL member country survey, the cascading impact of compromised data was felt across ransomware, BEC, identity theft, and mobile fraud ecosystems.
The Shadowserver Foundation identified more than 6,000 exploitable vulnerabilities across Africa in 2025, with the highest concentrations in South Africa, Kenya, and Nigeria, the same countries with the largest Internet user bases
The Communications Authority of Kenya reported hundreds of millions of intrusion attempts against government and information and communication technology (ICT) infrastructure 15 between July and September 2025, primarily via brute-force and system exploitation vectors.
Uganda’s Electricity Transmission Company Limited (UETCL) experienced a suspected ransomware incident in August 2025, marking a case involving a national power grid.16 The incident highlighted potential areas for improvement in critical infrastructure resilience and incident response coordination.
Business email compromise and romance scams targeting both corporate and individual victims were prolific in Central and West Africa.
Southern Africa’s ultra-high connectivity makes it a magnet for global threat actors seeking maximum disruption.
The financial toll of cybercrime in Africa is significant.
Since 2024, cybercrime-related losses have more than doubled, from USD 192 million to USD 484 million, driven primarily by AI-facilitated scams, credential harvesting, and automated social engineering campaigns.
According to the report, in 2025, online scams continued to be the most reported type of cybercrime, with attackers leveraging mobile money platforms, social media and AI to reach their targets.
Notably, 72 per cent of surveyed countries reported the presence of scam centres, with the highest concentration in Southern and West Africa.
Digital sextortion and online harassment, often facilitated by AI-generated deepfakes and synthetic media, remained pervasive, with some 600,000 sextortion detections recorded by TrendAI, one of several partners working with INTERPOL.
Similarly, the sophistication of Business E-Mail Compromise (BEC) schemes increased dramatically, with AI used to generate highly convincing e-mail correspondence, with Africa-based threat actors targeting victims in Europe and North America using infrastructure located across multiple jurisdictions.
The report reveals that the absence of real-time, inter-agency data sharing between banks, telecoms and law enforcement creates a dangerous blind spot in efforts to combat financial fraud.
This vulnerability is being exploited by criminals who have moved beyond simply stealing existing credentials to creating entirely synthetic identities.
Combining real personal data with fabricated elements, these AI-generated digital personas can bypass even advanced biometric verification systems and have been used to open bank accounts, secure mobile loans and register SIM cards under false names.
Neal Jetton, Director of INTERPOL’s Cybercrime unit said: “Cybercrime has emerged as one of the most significant criminal threats to the region. AI is automating every stage of a cyberattack from reconnaissance and phishing to extortion and evasion. However, we see that when countries work together, cybercriminal infrastructure can be identified, disrupted and dismantled.”
In 2025, 17 countries enacted or amended cybercrime legislation, including the launch of an online reporting platform in Senegal aimed at enhancing the response to online violations affecting children.
At the same time, regionally coordinated capacity building initiatives continue to strengthen long-term cyber resilience.
Four high impact cybercrime operations coordinated by INTERPOL including Operation Serengeti 2.0, Operation Contender 3.0, Operation Sentinel and Operation Red Card 2.0 collectively led to more than 1,500 arrests, the seizure of hundreds of devices and the recovery of over USD 100 million.
In its recommendations, the report calls for standardized digital forensic capabilities, enhanced cross-border cooperation, investment in AI literacy among law enforcement officers and formal-public private partnership to support effective prevention, detection and response.
Email your news TIPS to Editor@Kahawatungu.com — this is our only official communication channel
