Cyberattacks: Morocco Is Most Affected by Banking Trojans in Africa

Rabat – Morocco is the most affected African country by banking trojans and stealers malware with a staggering 18,827 attacks detected in 2022, according to the African Cyberthreat Assessment Report.

Banking Trojans are a type of malware that cybercriminals use to take control of a device or steal sensitive information. The malware is mostly used to harvest banking details and login credentials.

Trojans can be installed through phishing emails, malicious websites, drive-by downloads, or other means.

Published by Interpol, the report shows that South Africa ranks second after Morocco with 6,560 attacks detected, followed by Nigeria with 5,366 cases.

According to research cited in the Interpol report, cyber criminals in Morocco and elsewhere rely largely on social engineering, which includes tactics such as spoofing, impersonation, and malware attacks to gain access to confidential data.

In 2022, Japanese cybersecurity agency Trend Micro identified 7.7 million malicious web detections as part of their research. 40% of the malicious websites were scam websites.

Morocco was equally subject to the highest number of cyber extortion schemes in Africa, with 69% of extortion schemes detected in the North African country.

The country was also subject to another popular type of cybercriminal activity, ransomware; a cyberattack whereby cybercriminals target government, retail, or critical infrastructure including energy facilities, hospitals, and businesses.

Cybercriminals use ransomware to hold important devices or pieces of information “hostage,” locking users out of accessing the data until a ransom payment has been made.

South Africa is the most targeted by ransomware attacks in the continent with 42% of attacks, followed by Morocco with 8%, and Botswana and Egypt with 6%.

Trend Micro research further indicates that the source of 2% of extortion scams were traced back to South Africa, followed by Morocco at 2%. The data suggests that servers in these countries are either compromised – hacked and being used as proxy devices for cybercriminals elsewhere- or that the servers are part of a botnet used for malicious activities.