Artificial intelligence is now powering more than 55 percent of reported cybercrime across africanews.com, enabling perpetrators to launch faster, larger-scale, and more convincing attacks, according to the African Cyberthreat Assessment Report 2026 released by developingtelecoms.com.
Interpol Report Reveals AI Drives Over Half of Cybercrime in Africa as South Africa Faces Heavy Attacks
The 40-page assessment, which draws on information collected from 36 African countries, describes Southern Africa as the continent’s most digitally advanced and most heavily targeted region. South Africa faces a dominant share of ransomware, phishing, and business email compromise detections, according to findings cited from local media reports. Interpol’s cybercrime director, Neal Jetton, stated in a release that cybercrime has emerged as a significant criminal threat. AI is automating every stage of a cyberattack, from reconnaissance and phishing to extortion and evasion,
Jetton said, adding that international cooperation helps dismantle cybercriminal infrastructure.
Surging Financial Losses and Regional Cyber Threat Trends
Direct economic losses from cybercrime across Africa reached at least $5 billion in 2025, while reported financial losses surged 152 percent from $192 million in 2024 to $484 million in 2025, according to ecofinagency.com. During this period, identified victims increased from 35,000 to 87,000, driven by AI-facilitated scams, credential harvesting, and automated social engineering.
Online scams remained the most widespread and frequently reported cybercrime category across the continent in 2025, utilizing mobile money platforms, social media, and artificial intelligence. The report found that 72 percent of surveyed African countries reported scam centers operating within their borders, with the highest concentrations located in West and Southern Africa.
Distinct regional trends define the threat landscape:
- Southern Africa: Highly developed digital connectivity attracts global threat actors seeking maximum disruption, with South Africa accounting for 92 percent of all African ransomware detections recorded by TrendAI, 213,523 distributed denial-of-service attacks, nearly 40 percent of African phishing detections tracked by SOCRadar, and 70 percent of business email compromise detections in 2025.
- East Africa: Operates as a hub for mobile money fraud and ransomware attacks targeting critical infrastructure.
- West and Central Africa: Experience high levels of business email compromise and romance scams affecting both corporations and individuals.
Advanced Attack Vectors and Exploitable Vulnerabilities
Interpol’s technology partner TrendAI detected around 600,000 sextortion cases involving deepfake technology and AI-generated content. Furthermore, cybercriminals combined genuine personal data with fabricated details to create synthetic identities, enabling them to open bank accounts, obtain mobile loans, and register SIM cards while evading biometric verification systems.
Data compiled by the Shadowserver Foundation identified more than 6,000 exploitable vulnerabilities in Africa in 2025. South Africa, Kenya, and Nigeria accounted for the largest shares of these vulnerabilities, ranking among the continent’s largest internet markets.
| Rank | Country | Share |
|---|---|---|
| 1 | South Africa | 43.6% |
| 2 | Kenya | 11.9% |
| 3 | Nigeria | 9.1% |
| 4 | Senegal | 4.6% |
| 5 | Ethiopia | 3.3% |
Law Enforcement Gaps and International Operations
Enforcement efforts face substantial structural hurdles. The report notes that 92 percent of law enforcement agencies lack technical know-how in artificial intelligence, leaving only 8 percent of intelligence analysts with advanced AI expertise. Critics also noted that foundational legal instruments, such as the Malabo Convention, rely on early 2010s definitions and lack explicit coverage for modern AI-driven social engineering threats.
Despite these enforcement gaps, joint international operations yielded significant results. Four major coordinated operations—Operation Serengeti 2.0, Operation Contender 3.0, Operation Sentinel, and Operation Red Card 2.0—resulted in more than 1,500 arrests, the seizure of hundreds of electronic devices, and the recovery of over $100 million linked to cybercrime.
Related reading