Africa logs 42m web attacks in H1 2025, as Resilio Africa fights back

Sub-Saharan Africa recorded more than 42 million web-based cyberattacks and 95 million malware-driven on-device attacks in the first half of 2025, highlighting intensifying digital threats as governments and nonprofits expand online services.

The figures, drawn from a recent threat report by cybersecurity firm Kaspersky, place the region among the most aggressively targeted globally, with spyware, password-stealing programs and backdoor tools dominating the threat landscape. Password-stealing malware alone rose by more than 60 percent during the period, according to the report cited by cybersecurity advocates.

In East Africa, the challenge is even more pronounced. Kenya logged 2.5 billion cyber-threat events in the first quarter of 2025, largely driven by phishing schemes, mobile money fraud and misconfigured cloud systems.

“These are not abstract numbers. They directly affect institutions that people rely on every day,” Confidence Staveley, founder and executive director of Nigeria-based nonprofit CyberSafe Foundation, said at the launch of a new regional initiative in Lagos.

CyberSafe Foundation unveiled Resilio Africa, a three-year project backed by Google.org aimed at strengthening the cybersecurity resilience of 200 Critical Community Institutions across Nigeria, Kenya, Ghana and South Africa. The programme seeks to protect more than two million people and secure over 15 million public records in the four countries.

The Critical Community Institutions which include public agencies, schools, healthcare providers and nonprofit organisations, often operate with outdated or unpatched systems, limited cybersecurity budgets and little or no dedicated technical staff, Staveley said.

Read also: Nigerian regulators get billions in projects outside mandate

Beyond these visible gaps, she pointed to structural weaknesses such as limited cyber-risk quantification, rare incident response simulations, fragmented security policies and weak integration between cybersecurity planning and broader digital transformation strategies.

“The result is that many organisations can detect threats, but far fewer can respond quickly, reduce impact, or maintain operations during sustained attacks,” she said, adding that public and nonprofit institutions are among the hardest hit.

While awareness of cyber risks is growing across the continent, Staveley said action frequently stalls when financial commitments are required.

“In Africa, we are not lacking in general awareness that we have cyber risk issues. What happens is that the conversation drops off where it gets to the point of taking action,” she said, citing limited budgets as a major constraint.

Under Resilio Africa, participating institutions will receive cybersecurity assessments, technical tools, threat intelligence and structured incident response frameworks at no cost. The programme will also provide 10,000 hours of expert consulting support across the four countries. Staveley said the services would be valued at more than $1 million if billed commercially.

The launch comes as Nigeria prepares to introduce a new cybersecurity framework aimed at curbing AI-driven cyberattacks targeting banks, businesses and government agencies.

Kashifu Inuwa, director-general of the National Information Technology Development Agency (NITDA), has said the framework will set minimum cybersecurity spending thresholds, establish mandatory data breach reporting timelines and enhance threat intelligence sharing between the public and private sectors.

As digital adoption accelerates across Africa, analysts say the resilience of community institutions may prove critical to safeguarding public data and maintaining trust in the continent’s fast-growing digital economy.