NITDA issues urgent alert over ‘DeepLoad’ AI malware targeting Nigeria’s banks, government, and businesses

New advanced malware uses AI to evade detection, steals credentials from browsers, and can reactivate days after deletion.

 The National Information Technology Development Agency (NITDA) has issued a security alert over a new artificial intelligence-powered malware known as DeepLoad, warning that it is actively targeting government agencies, financial institutions, businesses, and individuals across Nigeria.

RELATED: NITDA warns Nigerians about Grandoreiro malware targeting banking data: How to stay safe

The warning, released on the agency’s X handle through its Computer Emergency Readiness and Response Team, comes as cyberattacks against Nigerian organisations continue to rise.

ADVERTISEMENT

What Is DeepLoad? A New Generation of AI-Driven Malware

According to NITDA, DeepLoad is a highly advanced malware strain designed to steal sensitive information while avoiding detection by traditional antivirus systems. It spreads through social engineering tactics, particularly fake website error prompts that trick users into running malicious commands.

“The malware is distributed through a social engineering technique involving a fake website error,” NITDA stated in its advisory.

Once executed, the malware installs itself quietly on a device and begins extracting stored credentials and sensitive data from major web browsers. It then uses artificial intelligence techniques to help it evade detection and remain active.

“Once executed, DeepLoad silently installs itself, harvests stored credentials and sensitive data from major browsers, and leverages artificial intelligence to evade antivirus detection,” the agency said.

A Persistent Threat: DeepLoad Reactivates Days After Deletion

NITDA also warned that DeepLoad has a persistence mechanism that makes it especially difficult to remove. The malware can reactivate itself days after it appears to have been deleted.

ADVERTISEMENT

“Critically, the malware incorporates a hidden WMI-based persistence mechanism capable of reactivating the infection up to three days after apparent removal,” the advisory stated.

The agency described the threat as serious and already active, urging immediate protective measures.

“Given its severity and confirmed active targeting of Nigerian entities, all organizations and individuals must implement the protective measures outlined in this advisory immediately.”

Who Is at Risk? Banks, Government, and Individuals

NITDA warned that individuals, businesses, and government institutions are all at risk. A successful infection could give attackers access to:

1. Bank accounts
2. Mobile money services
3. Payment cards
4. Passwords
5. Sensitive personal documents

The agency also raised concerns about identity theft, saying stolen information could be used to impersonate victims for financial gain.

Organisational Risks

For organisations, NITDA said infections could lead to major operational disruptions, including system shutdowns and costly recovery processes. It also warned that breaches in government systems could compromise classified data and national security infrastructure.

ADVERTISEMENT

How to Protect Against DeepLoad

Basic Precautions

Organisational Measures

Organisations were also urged to:

• Educate staff on recognising social engineering tactics
• Monitor systems for hidden persistence mechanisms
• Isolate any suspected infected devices immediately

What to Do If Infected

NITDA concluded that any confirmed or suspected incident should be reported quickly, with the following steps:

1. Disconnect affected systems from the internet immediately
2. Reset passwords from secure, clean devices
3. Activate internal response teams within hours to contain the threat

Key Takeaways