NITDA Alerts on AI Malware Threatening Nigerian Institutions
Introduction to DeepLoad: A New AI-Powered Malware Threat
The National Information Technology Development Agency (NITDA) has issued a critical security alert regarding a newly discovered malware known as DeepLoad. This advanced threat is actively targeting government agencies, financial institutions, businesses, and individuals across Nigeria. The warning was shared through NITDA’s official X handle, highlighting the growing concern over cyberattacks in the country.
DeepLoad represents a significant evolution in malware technology, leveraging artificial intelligence to evade traditional security measures. According to NITDA, the malware spreads through social engineering tactics, often using fake website error prompts to trick users into executing malicious commands.
How DeepLoad Operates
Once executed, DeepLoad installs itself silently on a device and begins extracting stored credentials and sensitive data from major web browsers. It uses artificial intelligence techniques to avoid detection by antivirus systems, making it particularly dangerous. The malware is designed to remain active and difficult to remove, with a persistence mechanism that allows it to reactivate itself even after being seemingly deleted.
“Critically, the malware incorporates a hidden WMI-based persistence mechanism capable of reactivating the infection up to three days after apparent removal,” the advisory stated. This feature makes it especially challenging for users and organizations to fully eliminate the threat.
Risks and Consequences
NITDA warned that DeepLoad poses a serious threat to all entities, including individuals, businesses, and government institutions. A successful infection could grant attackers access to bank accounts, mobile money services, payment cards, passwords, and sensitive personal documents. The agency also raised concerns about identity theft, as stolen information could be used to impersonate victims for financial gain.
For organizations, the consequences of an infection could be severe, leading to operational disruptions such as system shutdowns and recovery processes. Breaches in government systems could compromise classified data and national security infrastructure.
Protective Measures Against DeepLoad
To prevent infection, NITDA advised users not to copy or execute commands from unknown websites. The agency emphasized that legitimate software providers do not require such actions. Additionally, users were warned against installing software from unverified USB drives and recommended scanning all external storage devices before use.
Other key recommendations included:
- Enabling two-factor authentication on important accounts
- Avoiding storing banking passwords in browsers
- Reviewing browser extensions for suspicious activity
- Blocking known malicious domains at the firewall and DNS level
- Enabling advanced logging tools on Windows systems
Organizations were also urged to educate staff, monitor systems for hidden persistence mechanisms, and isolate any suspected infected devices immediately.
Reporting and Containing the Threat
NITDA concluded that any confirmed or suspected incident should be reported quickly. Affected systems should be disconnected from the internet, passwords reset from secure devices, and internal response teams activated within hours to contain the threat.
