<p>Between December 2025 and January 2026, <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.bloomberg.com/news/articles/2026-02-25/hacker-used-anthropic-s-claude-to-steal-sensitive-mexican-data">a single unknown person used a consumer AI chatbot to systematically dismantle the cybersecurity defences of the government of Mexico</a>. By the time anyone noticed, 150 gigabytes of data was gone — tax records tied to 195 million taxpayers, voter files, government credentials, and civil registry documents spanning Mexico's federal tax authority, its electoral institute, four state governments, and a water utility.</p><p>The tool was not a sophisticated nation-state hacking suite. It was a consumer AI chatbot. The attacker's conversation logs were found publicly accessible online when the breach came to light on February 25.</p><p>The method was not technically novel. What made it effective was patience and AI-assisted persuasion, the ability to craft perfectly targeted social engineering at scale, probe defences continuously without fatigue, and adapt to each new barrier without human oversight slowing the attack down.</p><p>Kenya has built something similar to what Mexico lost except larger and more centralised. Over 13 million Kenyans are registered on eCitizen. More than 16,000 government services sit on a single platform. The Maisha Namba digital ID is issuing up to 30,000 new IDs every day. The question of whether Kenya's cyber defences are ready for AI-assisted attacks is not hypothetical. It is urgent.</p><h2>The Ksh 29.9 Billion We Already Know About</h2><p>Before discussing where cyber threats are heading, the current baseline deserves to be stated clearly.</p><p>Kenya lost Ksh 29.9 billion to cybercrime in 2024/2025. That figure comes from the <a target="_blank" rel="noopener noreferrer nofollow" href="https://www.serianu.com/downloads/Africa%20Cybersecurity%20Report%20-%20Kenya.pdf">Africa Cybersecurity Report Kenya 2024/2025,</a> produced by Serianu, one of the continent's most credible cybersecurity research institutions, based on responses from 280 organisations. Continent-wide, Africa lost Ksh 650 billion, roughly $5 billion, in the same period.</p><ad-spot></ad-spot><p>Payment fraud was the most common incident category, driven by real-time mobile money transfers, weak transaction monitoring systems, and social engineering attacks that exploit the trust that makes M-Pesa so frictionless in legitimate use. Online and email fraud accounted for 40% of all incidents and 32% of recorded losses, pointing to persistent gaps in how organisations manage digital identity verification. SIM-swap attacks and mobile money fraud remain widespread despite what Serianu describes as "improved controls", a diplomatic way of saying the controls are not keeping up with the attackers.</p><p>A specific case from 2025 illustrates the gap between controls and outcomes: attackers compromised a digital payments portal, disabled OTP notifications, and funnelled Ksh 49 million into mobile wallets, bank accounts, and till numbers before the breach was detected. In a separate incident, a syndicate stole over Ksh 6 million from a commercial bank. Both were carried out with relatively conventional methods. Neither required AI.</p><p>The Ksh 29.9 billion figure is sobering on its own. What Serianu's CEO William Makatiani said at the report's launch is more sobering still: "The rate at which organisations are investing is improving, but attackers are advancing even faster."</p><p>That gap, between the pace of investment in defence and the pace of offensive capability, is where AI enters the picture.</p><h2>What AI Has Already Changed for Attackers</h2><p><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.bcg.com/publications/2025/ai-raising-stakes-in-cybersecurity">A global survey of 500 senior leaders</a> by Boston Consulting Group, published in December 2025, quantified the defensive side of this gap. Only 7% of organisations globally have deployed AI tools in their cyber defence. Meanwhile, approximately 60% have likely already experienced an AI-powered attack in the past year. The defensive majority is fighting with 2019-era tools against attackers who have fully adopted 2026 capabilities.</p><ad-spot></ad-spot><p>The BCG report identifies three structural shifts that make AI-enabled attacks categorically different from what came before.</p><p>The first is scale and speed. AI enables attackers to hunt for vulnerabilities across thousands of systems simultaneously, generate personalised phishing content at industrial volume, and probe defences continuously without the fatigue or cost constraints that limit human attackers. A campaign that previously required a team of analysts working over weeks can now be initiated and iterated by one person with a laptop and an API key.</p><p>The second is autonomous operation. AI has moved from static models to agentic systems, AI that can observe, reason, and act across multiple steps without human oversight. The Mexico breach demonstrated this: the attacker used AI to sustain a patient, multi-stage intrusion across months, adapting to each defensive response without escalating resources or personnel. Autonomous attacks can probe continuously, adapt instantly to defensive signals, and maintain operational tempo that human defenders cannot match in real time.</p><p>The third is identity collapse. Deepfakes, voice cloning, and synthetic identity generation have undermined authentication as a reliable safeguard. The BCG survey found that AI-generated deepfake video has already been used to impersonate a CFO in a live video call, resulting in a $25 million fraud loss at a multinational engineering firm. Voice cloning was used to spoof election-related robocalls, resulting in a $1 million regulatory fine for a telecom provider. When you cannot trust that the voice or face on your screen belongs to the person it claims to be, the entire model of identity-based verification collapses.</p><p>Kenya's digital economy is built on identity verification. M-Pesa PIN entry. OTP confirmation. Biometric matching at eCitizen kiosks. SIM registration against national ID. Every one of these controls was designed for a threat environment where forgery was expensive and required physical proximity. AI has made sophisticated forgery cheap, scalable, and remote.</p><h2>Why Kenya Is a High-Value Target</h2><p>Kenya's appeal to cybercriminals is a function of the same qualities that make its digital economy a regional success story.</p><p>M-Pesa processes hundreds of billions of shillings in transactions every month, with the frictionless speed that makes mobile money genuinely useful also creating opportunities for real-time fraud before monitoring systems flag anomalies. The eCitizen platform centralises access to government services at a scale that, if compromised, would expose millions of citizen records in a single breach. Kenya's position as East Africa's technology hub means it hosts the regional offices, data centres, and payment processing infrastructure of companies operating across multiple countries, making it a gateway target whose breach has continental consequences.</p><ad-spot></ad-spot><p>The Serianu report notes that Kenya's digital infrastructure remains significantly exposed at the network layer. Many devices remain accessible through open, unencrypted remote-access services (Telnet, FTP, RDP) that should have been secured or decommissioned years ago. Operational errors and system misconfigurations compound the attack surface, particularly in public sector institutions where IT staffing and budget constraints are most acute.</p><p>Kenya also has the third-highest number of internet users in sub-Saharan Africa and among the highest mobile money penetration rates globally. From an attacker's perspective, this is not a liability, it is an opportunity. More users, more transactions, more endpoints, more attack surface, and a regulatory and enforcement environment that is still building the capacity to respond at the speed and sophistication that AI-enabled attacks require.</p><h2>The eCitizen Problem Nobody Is Talking About Loudly Enough</h2><p>The Mexico breach warrants specific attention in the Kenyan context because the structural parallels are uncomfortable.</p><p>Mexico's breach exploited centralised government infrastructure, a single point of failure whose compromise gave the attacker access to data spanning multiple agencies. eCitizen is Kenya's equivalent architecture. The platform's value proposition is precisely its centralisation: one login, one identity, access to thousands of services. That centralisation is also its vulnerability. A successful attack against eCitizen's authentication layer, or against the identity verification systems that underpin Maisha Namba, would not be a single agency breach. It would be a systemic one.</p><p>Kenya's government moved faster on digital transformation than on the security architecture to protect it. The Maisha Namba rollout, the eCitizen expansion, the integration of biometric data across health, education, and financial services, these are genuinely impressive infrastructure achievements. But each integration point is also a potential attack surface, and the BCG survey's finding that 88% of organisations plan to deploy AI defence but only 7% have done so yet describes a gap that attackers are exploiting right now.</p><p>The government is aware of this. Secretary to the Cabinet Mercy Wanjau, speaking at the Serianu report launch, announced the establishment of a Government Security Operations Centre, a centralised national cyber-monitoring facility. That is the right structural response. The implementation timeline, resourcing, and integration with existing agency security teams will determine whether it arrives before the next major incident or after it.</p><h2>What Organisations and Individuals Can Do Now</h2><p>For businesses and institutions operating in Kenya, the BCG and Serianu findings point to concrete priorities rather than abstract awareness.</p><p><strong>Identity governance is the most urgent gap.</strong> Both reports identify identity management, how you verify who is accessing what, as the primary attack surface for AI-enabled threats. Multi-factor authentication that relies solely on SMS OTPs is no longer sufficient, as SIM-swap attacks can intercept those codes. Authenticator apps, hardware security keys, and biometric verification tied to the actual device rather than a phone number are more resilient options. For organisations processing significant financial transactions, these are not optional upgrades.</p><ad-spot></ad-spot><p><strong>Recovery readiness matters as much as prevention.</strong> The shift Serianu recommends (from risk management to resilience) reflects a hard-won insight from organisations that have been breached: prevention will sometimes fail. Immutable backups, routine recovery testing, and documented incident response procedures determine whether a breach becomes a recoverable disruption or a catastrophic loss. The organisations that recovered fastest from the attacks documented in the Serianu report were those with functioning recovery systems, not necessarily those with the most sophisticated perimeter defences.</p><p><strong>AI-assisted monitoring is now table-stakes for financial institutions.</strong> Real-time transaction monitoring that flags anomalies (unusual patterns, atypical access times, out-of-pattern transfer destinations) needs to operate at the speed of AI-enabled attacks, which means it needs AI assistance. Human analysts reviewing logs after the fact cannot catch attacks that complete in minutes. This is not a future consideration for Kenya's banks, fintechs, and mobile money operators. It is a current gap that Serianu's documented incidents have already exploited.</p><p><strong>Consumer awareness remains the cheapest layer of defence.</strong> Enabling two-step verification on all financial accounts. Confirming transfer requests through a separate channel before executing them. Being sceptical of urgent requests from known contacts (particularly voice or video calls requesting money or credentials) since both can now be convincingly faked. These behaviours cost nothing and intercept the social engineering attacks that remain the most common entry point for Kenya's most costly breaches.</p><h2>The Asymmetry That Needs to Close</h2><p>Kenya is in a position that is not unique but is particularly acute. It has built digital infrastructure fast enough to create real economic value (M-Pesa's role in financial inclusion, eCitizen's role in service delivery, Maisha Namba's potential to anchor a unified digital identity) but the security architecture protecting that infrastructure has not kept pace with either the sophistication of the threats or the centralisation of the target.</p><p>The Ksh 29.9 billion in losses documented by Serianu is a 2024/2025 figure. It reflects attacks carried out with largely conventional tools. AI-enabled attacks are already underway globally, the BCG survey's 60% figure represents organisations that have already experienced them, and Kenya's attack surface is large, high-value, and in several areas still inadequately protected.</p><p>The Mexico breach should be read as a preview, not a warning about somewhere else. The same consumer AI tools are available to the same global threat actors targeting Kenya. The centralised digital infrastructure that makes Kenya's government services efficient makes it a similarly attractive target. The response gap, between organisations that understand the risk and those actively deploying AI-native defences, is the window that attackers are operating in right now.</p><p>Closing that window is not primarily a technology problem. It is a resource, urgency, and prioritisation problem. The technology to defend against AI-enabled attacks exists. The organisations and institutions that deploy it at speed and scale will be the ones that are not in next year's Serianu report.</p>

Kenya Lost Ksh 29.9 Billion to Cybercrime Last Year. AI Is About to Make That Number Much Worse.

<p>A new type of Android malware is making headlines this week, and it is unlike anything security researchers have seen before. Discovered by cybersecurity firm ESET, a malware strain called PromptSpy is the first ever Android malware to use generative AI — specifically Google's own Gemini — to take over your phone. It can record your screen, steal your lock screen PIN, block you from uninstalling it, and hand a remote attacker full control of your device.</p><p>While PromptSpy appears to have primarily targeted users in Argentina and may still be in its early stages, the discovery is a clear signal: Android threats are getting smarter. For the millions of Kenyan smartphone users who rely on their phones for mobile banking, M-Pesa transactions, business communication, and everyday life, this is the right moment to take Android security seriously.</p><p>This guide walks you through practical, straightforward steps to protect your Android phone in 2026.</p><h2>What Makes PromptSpy Different — And Why It Matters</h2><p>Before getting into the how-to steps, it helps to understand why security researchers are paying attention to this threat.</p><p>Most Android malware works by hardcoding specific screen coordinates or button locations. The problem is that these coordinates break easily across different phone models, screen sizes, and Android versions. Attackers have had to build separate versions of malware for different devices — an expensive and time-consuming process.</p><p>PromptSpy changes that. It sends Google's Gemini a description of whatever is currently on the phone's screen, and Gemini responds with instructions on exactly what the malware should tap or swipe. This means the malware can adapt to virtually any Android device, any screen layout, and any Android version automatically. It is a significant upgrade in how flexible and dangerous mobile malware can be.</p><p>Beyond the AI angle, PromptSpy can capture your lock screen PIN, record your screen as a video, take screenshots, block you from uninstalling it using invisible overlays over buttons, and give attackers full remote access to your phone through a VNC module. Importantly, it is distributed through a fake banking app website and has never appeared on the Google Play Store.</p><p>The good news is that Google Play Protect already blocks known versions of it. The better news is that the steps that protect you from PromptSpy are the same steps that protect you from the vast majority of Android threats in general.</p><ad-spot></ad-spot><h2>Step 1: Only Install Apps From the Google Play Store</h2><p>This one step alone would stop most Android malware, including PromptSpy.</p><p>PromptSpy was never on the Play Store. It was distributed through a dedicated website disguised as a banking app. Users who only install apps through the Play Store would never have encountered it in the first place.</p><p>In Kenya, it is common to download APK files from WhatsApp groups, Telegram channels, or random websites — especially for apps that are not available locally, paid apps people want for free, or modified versions of popular apps. This habit carries significant risk. APK files downloaded outside the Play Store have not been reviewed by Google's security systems.</p><p>To check your settings, go to Settings, then Security, and look for an option called "Install Unknown Apps" or "Unknown Sources." Make sure this is turned off for all apps. On Android 8 and above, you can control this permission on a per-app basis.</p><h2>Step 2: Keep Google Play Protect Turned On</h2><p>Google Play Protect is a built-in security feature that scans apps on your phone for malware. It is free, runs automatically in the background, and is one of your best defences against threats like PromptSpy.</p><p>ESET confirmed that Play Protect already protects against known versions of PromptSpy. This only works, however, if Play Protect is actually enabled on your device.</p><p>To check, open the Play Store app, tap your profile picture in the top right corner, tap "Play Protect," and make sure it shows as active. You can also run a manual scan from this screen. If Play Protect is turned off, turn it back on immediately.</p><h2>Step 3: Be Very Careful With Accessibility Permissions</h2><p>This is one of the most important — and most overlooked — security steps on Android.</p><p>Accessibility Services are features designed to help people with disabilities use their phones. They allow apps to read what is on the screen, simulate taps and swipes, and interact with other apps. These are powerful capabilities, and malware loves them.</p><p>PromptSpy abuses Accessibility Services to place invisible overlays over the "Uninstall" button and other system controls, making it impossible for users to remove it through normal means. Many other Android malware families do the same thing.</p><p>You should only grant Accessibility permissions to apps you fully trust and genuinely need them for — such as a screen reader or a password manager like Bitwarden. If a random app you downloaded asks for Accessibility access, that is a major red flag.</p><p>To review which apps have Accessibility access on your phone, go to Settings, then Accessibility, then Installed Apps or Downloaded Apps depending on your phone model. If you see any apps there that should not need those permissions, revoke them immediately.</p><ad-spot></ad-spot><h2>Step 4: Use a Strong Screen Lock</h2><p>PromptSpy is specifically designed to capture your lock screen PIN and record your unlock pattern as a video. This makes your screen lock your first line of defence.</p><p>A six-digit PIN is much stronger than a four-digit one. A strong alphanumeric password is stronger still. Pattern unlocks are the weakest option — they are easy to record and easy to guess from smudge marks on the screen.</p><p>Fingerprint authentication is a good complement to a strong PIN because it reduces how often you type your PIN in public. Set it up if your phone supports it, but make sure you still have a strong PIN as a backup since biometrics can be bypassed in some circumstances.</p><p>To set or change your screen lock, go to Settings, then Security, then Screen Lock.</p><h2>Step 5: Keep Your Phone and Apps Updated</h2><p>Malware frequently exploits security vulnerabilities in outdated versions of Android or popular apps. Keeping your phone updated closes these holes before attackers can use them against you.</p><p>Go to Settings, then System, then Software Update, and check for any pending updates. Do the same for your apps by opening the Play Store, tapping your profile picture, and selecting "Manage Apps and Device" to see if any updates are waiting.</p><p>Updates are especially important for your browser, banking apps, and any app that handles sensitive data.</p><h2>Step 6: Watch Out for Fake Banking Apps</h2><p>PromptSpy disguised itself as a fake Chase Bank app. In Kenya, similar attacks often impersonate M-Pesa, Equity Bank, KCB, or other locally trusted financial platforms.</p><p>The signs to watch for include being directed to a website or WhatsApp group to download a banking app rather than finding it on the Play Store, apps that ask for more permissions than necessary (a banking app does not need Accessibility access or the ability to record your screen), slight variations in app names or icons that look almost right but not quite, and messages from strangers or suspicious accounts urging you to install a financial app urgently.</p><p>When in doubt, go directly to the official Google Play Store, search for your bank by name, and install only the app listed there with the most downloads and reviews.</p><h2>Step 7: Use Two-Factor Authentication on Your Important Accounts</h2><p>Even if malware does manage to steal your password, two-factor authentication (2FA) adds a second layer of defence. An attacker would need both your password and access to your phone or email to log into your account.</p><p>Enable 2FA on your Google account, your banking apps, your email, and any other account that supports it. Google Authenticator and Microsoft Authenticator are both solid options for generating one-time codes. Some services will also send a code via SMS, which is better than nothing even though SMS-based 2FA is weaker than app-based options.</p><p>To enable 2FA on your Google account, go to myaccount.google.com, click Security, and look for "2-Step Verification."</p><ad-spot></ad-spot><h2>Step 8: What to Do If You Think Your Phone Is Already Infected</h2><p>If your phone is behaving strangely — the battery drains unusually fast, the phone is hot when idle, data usage has spiked, or you cannot remove an app — there is a possibility malware is running on it.</p><p>For PromptSpy specifically, the only way to remove it through normal means is to reboot your phone into Safe Mode. In Safe Mode, third-party apps are disabled, which means the invisible overlays blocking the Uninstall button will no longer work. You can then go to Settings, then Apps, find the suspicious app, and uninstall it normally.</p><p>To boot into Safe Mode on most Android phones, press and hold the power button, then long-press the "Power Off" option until a "Safe Mode" prompt appears. Tap OK. The process varies slightly between manufacturers, so search for "how to boot into safe mode" followed by your specific phone model if the above does not work.</p><p>After removing the suspicious app, run a Google Play Protect scan, change all your important passwords, and check your bank accounts for any unusual activity.</p><p>If you are not comfortable doing this yourself, take your phone to a trusted phone repair shop or contact your mobile carrier for support.</p><h2>The Bigger Picture</h2><p>PromptSpy is being described by researchers as potentially a proof of concept rather than a full-scale attack campaign. But the direction it points in is clear. Attackers are beginning to use AI to make malware more adaptable, more persistent, and harder to detect. This is not a trend that will reverse.</p><p>For Kenyan smartphone users, the stakes are high. Our phones are our banks, our businesses, and our connections to family and work. Taking a few minutes to check the settings outlined in this guide is a worthwhile investment.</p><p>The steps are not complicated. Stick to the Play Store. Keep Play Protect on. Be stingy with Accessibility permissions. Use a strong screen lock. Update your phone regularly. Those five habits alone will protect you from the overwhelming majority of Android threats in 2026.</p>

Cybersecurity

Kenya Lost Ksh 29.9 Billion to Cybercrime Last Year. AI Is About to Make That Number Much Worse.

How to Secure Your Android Phone in 2026: A Complete Guide for Kenyan Smartphone Users

The "Guaranteed Win" Illusion: Inside Kenya's Betting & Forex Prediction Scams