By Martin Ekpeke
Kaspersky’s detection systems stopped 1.6 million online attacks targeting Nigerian users in the first half of 2026, with 18.4% of users in the country targeted by web-based threats.
The figures were revealed by Kaspersky’s Global Research & Analysis Team (GReAT) during its annual Cyber Security Weekend for the Middle East, Türkiye, and Africa (META) region.
The data highlights a rapidly changing digital risk landscape driven by web exploitation, email phishing, and the growing integration of artificial intelligence (AI) by cybercriminals.
Across the broader META region, cyber threats exploiting vulnerabilities in websites, emails, and web services continue to impact millions of internet users.
While South Africa logged the highest overall volume of blocked attacks among African nations at 5.7 million, followed by Kenya at 4.5 million, Nigeria recorded 1.6 million blocked online attacks.
Türkiye led the region in proportion of affected internet users at 22.8%, while Saudi Arabia, Jordan, and Pakistan recorded the lowest percentages of users targeted by web-borne attacks.
Beyond raw numbers, Kaspersky experts warned that large language models (LLMs) and generative AI are fundamentally altering attacker workflows, enabling threat actors to lower operational costs and iterate malicious tools much faster.
“By lowering the time and cost required to develop and adapt malicious tools, AI allows threat actors to iterate faster and scale their efforts. Defenders should be prepared for quicker shifts in tactics,” Sergey Lozhkin, Head of Global Research and Analysis Team (APAC & META), Kaspersky
Artificial intelligence is no longer just generating convincing phishing emails, as it is increasingly involved in direct malware development. Kaspersky cited recent examples of this shift, including the FunkSec Group, which deployed Rust-based malware developed with AI assistance for data theft, encryption, and process manipulation, as well as the RevengeHotels campaign, where threat actors used large language models to generate core infector and downloader code modules.
Furthermore, Kaspersky outlined five major emerging cybersecurity trends reshaping corporate and consumer risk across the region. First, AI-driven malware evolution allows generative models to rewrite existing malware across different programming languages or system architectures, making code significantly harder for signature-based tools to detect.
Second, malicious AI skills and hijacked agents pose a threat as enterprises deploy autonomous AI agents with elevated privileges, where compromised tools or altered system prompts can turn trusted internal AI assistants into persistent backdoors.
Third, cloud-based data exfiltration is rising, with attackers increasingly routing stolen data through legitimate cloud storage and file-sharing platforms to blend into everyday network traffic.
Fourth, operational ransomware disruption is expanding, as threat groups prioritize direct disruption to operational and manufacturing processes alongside traditional file encryption to compel faster ransom payouts.
Finally, persistent AI bootstrapping presents a key risk, as compromised AI configuration files can force local agents to fetch and execute malicious payloads every time a system boots up.
Kaspersky advises public and private sector organizations in Nigeria and the broader META region to reinforce their defenses through continuous vulnerability management, proactive employee awareness training, real-time threat intelligence integration, and threat-hunting platforms like Kaspersky Next.