ESET warns of AI-driven deepfake scams and malware in Kenya and South Africa
Security firm ESET reported in its H2 2025 threat analysis that AI-enhanced deepfake scams and malware pose significant cybersecurity risks in Kenya and South Africa. The report documented increased detections of deepfake-driven investment fraud, HTML-based Nomani scams growing 62% annually, and the emergence of PromptLock, reportedly the first AI-driven ransomware capable of generating malicious scripts on demand.
What happened
According to ESET's H2 2025 Threat Report, phishing and social engineering accounted for 45.7% of detected threats in South Africa. Detections of HTML-based Nomani investment scams grew 62% year-over-year, with these scams expanding from Meta to other platforms including YouTube and employing higher-resolution deepfake videos, AI-generated phishing websites, and short-lived advertising campaigns.
In Kenya, ESET identified deepfake-driven fraud as a significant risk, with a high-profile incident where a deepfake video impersonated a prominent Kenyan political figure to promote a fraudulent investment scheme. ESET discovered PromptLock in H2 2025, reportedly the first AI-driven ransomware capable of generating malicious scripts on demand at speed.
Reported impact
Phishing remained the leading initial access vector affecting South African companies. In Kenya, ESET noted that deepfake videos can accelerate the reach and impact of scams, with organizations falling victim to investment fraud driven by realistic deepfake impersonations.
ESET Research projected a 40% year-on-year increase in publicly reported ransomware victims globally compared with 2024, though under-reporting in Kenya made measuring the true severity difficult.
Index analysis
ESET telemetry showed an 87% increase in NFC threats in the second half of 2025, with attacks relying on social engineering to persuade victims to install malicious Android applications that relay card data and PINs in real time. In South Africa, widespread reliance on card-based payment systems made this class of attack more relevant than in regions where mobile money platforms dominate.
While fully AI-generated malware remained an emerging threat, experts warned it was already being used to enhance phishing and scam techniques spreading across Kenya, with the Nomani scam showcasing accelerated evolution in scam activity.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.