The National Information Technology Development Agency (NITDA), have warned that a new artificial intelligence-powered malware identified as DeepLoad is actively targeting government institutions, financial organisations, businesses and individuals across the country. The alert was issued through the agency’s Computer Emergency Readiness and Response Team via its X handle, on Thursday,……
The National Information Technology Development Agency (NITDA), have warned that a new artificial intelligence-powered malware identified as DeepLoad is actively targeting government institutions, financial organisations, businesses and individuals across the country.
The alert was issued through the agency’s Computer Emergency Readiness and Response Team via its X handle, on Thursday, May 7, amid growing concerns over increasing cyberattacks against Nigerian entities.
According to NITDA, DeepLoad is a sophisticated malware strain built to steal sensitive information while avoiding detection from conventional antivirus systems.
The agency disclosed that the malware spreads through social engineering methods, particularly fake website error messages designed to trick unsuspecting users into executing harmful commands.
“The malware is distributed through a social engineering technique involving a fake website error,” the agency stated.
READ ALSO: NITDA Reaffirms Commitment To Advancing Digital Transformation
NITDA explained that once activated, the malware installs itself silently on infected devices before harvesting passwords, credentials and other confidential information stored on web browsers.
“Once executed, DeepLoad silently installs itself, harvests stored credentials and sensitive data from major browsers, and leverages artificial intelligence to evade antivirus detection,” the agency said.
The agency further warned that the malware possesses a hidden persistence mechanism capable of restoring the infection even after users believe it has been removed.
“Critically, the malware incorporates a hidden WMI-based persistence mechanism capable of reactivating the infection up to three days after apparent removal,” the advisory stated.
Describing the threat as severe and already active within Nigeria’s digital space, NITDA urged organisations and individuals to immediately adopt preventive measures.
“Given its severity and confirmed active targeting of Nigerian entities, all organizations and individuals must implement the protective measures outlined in this advisory immediately,” it added.
NITDA warned that successful attacks could expose victims to financial theft, identity fraud and loss of confidential records.
According to the agency, attackers may gain access to bank accounts, payment cards, mobile money platforms, passwords and personal documents.
It also cautioned that stolen credentials could be used for impersonation and other fraudulent activities.
For businesses and government institutions, NITDA warned that infections could trigger operational shutdowns, costly recovery processes and breaches involving sensitive national infrastructure.
The agency advised Nigerians not to copy or run commands from suspicious websites, stressing that genuine software providers do not request such actions from users.
It also cautioned against installing applications from unverified USB devices and urged users to scan all external storage drives before use.
Other recommendations included enabling two-factor authentication on sensitive accounts, avoiding the storage of banking passwords on browsers, checking browser extensions for suspicious activity, blocking malicious domains at firewall and DNS levels, and activating advanced logging systems on Windows devices.
NITDA also urged organisations to train employees on cybersecurity threats, monitor systems for hidden malware persistence tools and immediately isolate any device suspected to have been infected.
The agency added that suspected or confirmed attacks should be reported immediately, while affected systems should be disconnected from the internet and passwords changed using secure devices as part of emergency containment measures.
