Cybersecurity company NordVPN, has warned that cybercriminals are impersonating popular companies and government agencies across Africa in a campaign designed to take over smartphones and bank accounts.
It said that more than 100 fake websites linked to the malware campaign have been identified since August 2025.
According to the report, brands including DStv, Takealot and South African Airways, as well as the South African Revenue Service (SARS), are being used to make fraudulent messages and websites appear legitimate.
NordVPN explained that the campaign distributes Remote Access Trojans (RATs) and banking trojans, forms of malware that can give criminals control over infected devices and access to sensitive information.
The attacks are particularly concerning in South Africa, where Android dominates the mobile operating system market.
The attacks are particularly concerning in South Africa, where Android dominates the mobile operating system market.
NordVPN said the attacks typically begin with social engineering, where criminals send convincing messages through SMS, WhatsApp or social media.
The messages may contain urgent offers or requests involving job opportunities, tax refunds, identity renewals or pension verification.
Victims are then directed to fake websites designed to closely resemble the official websites of trusted organisations.
The sites encourage users to download an Android application. Once installed, the malicious software can operate quietly in the background, including after the smartphone is restarted.
