NITDA Raises Cybersecurity Alert Over AI-Powered DeepLoad Malware

The National Information Technology Development Agency (NITDA) has issued a fresh cybersecurity warning over a newly identified artificial intelligence-powered malware known as DeepLoad, cautioning that the threat is actively targeting Nigerian government institutions, financial organisations, businesses, and individual users.

The alert was contained in a critical advisory released on May 6 through the agency’s Computer Emergency Readiness and Response Team (CERRT.NG) and disseminated via its official X account. NITDA said the malware represents a significant escalation in cyber threats affecting Nigeria’s digital ecosystem, particularly at a time when attacks on public and private infrastructure are increasing.

According to the agency, DeepLoad is an advanced malware strain enhanced with artificial intelligence capabilities, designed to infiltrate computer systems, harvest sensitive data, and evade traditional cybersecurity detection tools. It noted that the malware is currently being deployed through social engineering techniques that exploit user behaviour and system vulnerabilities.

“The malware is distributed through a social engineering technique involving fake website error,” the advisory stated.

NITDA explained that the attack typically begins when users encounter deceptive prompts on compromised or fake websites. These prompts are designed to trick users into executing malicious commands on their devices, often under the impression that they are performing legitimate troubleshooting or software installation steps.

Once executed, DeepLoad installs itself silently on the system, embedding deeply within the device architecture. The agency warned that the malware is capable of harvesting stored credentials, including usernames and passwords saved on major web browsers, as well as other sensitive personal and financial data.

“Once executed, DeepLoad silently installs itself, harvests stored credentials and sensitive data from major browsers, and leverages artificial intelligence to evade antivirus detection,” the agency said.

NITDA further highlighted that one of the most concerning features of the malware is its persistence mechanism, which allows it to survive standard removal attempts. The agency stated that DeepLoad incorporates a hidden Windows Management Instrumentation (WMI)-based function that enables reactivation of the malware days after it appears to have been removed.

“Critically, the malware incorporates a hidden WMI-based persistence mechanism capable of reactivating the infection up to three days after apparent removal,” it stated.

The agency described the threat as severe, noting that it requires immediate preventive and corrective actions from both individuals and organisations across all sectors. It added that Nigerian entities are already being actively targeted, increasing the urgency of the advisory.

“Given its severity and confirmed active targeting of Nigerian entities, all organizations and individuals must implement the protective measures outlined in this advisory immediately,” NITDA added.

NITDA warned that successful infections could have far-reaching consequences, including financial fraud, identity theft, operational disruptions, and potential breaches of sensitive government systems. The agency said individuals risk losing access to bank accounts, mobile money platforms, payment cards, and other digital financial services.

It also noted that compromised data could be used to impersonate victims, facilitating identity fraud and other cybercriminal activities. For organisations, the impact could extend to system-wide disruptions, requiring full isolation of affected infrastructure and extensive remediation processes.

The agency further cautioned that attacks targeting government institutions could compromise classified networks, thereby posing broader national security risks.

To mitigate the threat, NITDA advised users to avoid executing commands copied from websites, stressing that legitimate software providers do not request such actions. It also warned against opening suspicious installer files such as “Chrome Setup” or “Firefox Installer” from external storage devices without proper verification.

Users were advised to scan all USB drives and external storage devices with updated antivirus software before use. NITDA also recommended enabling two-factor authentication across sensitive accounts and avoiding the storage of banking credentials directly on web browsers.

For organisations, the agency urged immediate staff sensitisation on the DeepLoad threat and recommended enabling PowerShell Script Block Logging across Windows environments. It also advised routine review of browser extensions to detect and remove unauthorised or malicious installations.

Additionally, organisations were directed to block identified malicious domains, including holiday-updateservice[.]com, forest-entity[.]cc, and hell1-kitty[.]cc, at firewall and DNS levels.

NITDA also advised system administrators to check for hidden WMI Event Subscriptions, which may allow the malware to persist even after cleanup procedures.

In response to suspected infections, the agency recommended immediate disconnection of affected systems from the internet, password resets from secure devices, isolation of compromised systems, activation of incident response teams, and mandatory reporting to the agency within 72 hours, in line with regulatory requirements.

NITDA reiterated that the growing sophistication of AI-powered malware requires heightened vigilance and coordinated cybersecurity responses across all sectors of the economy.