Glenn456/kenya-threat-landscape

Threat intelligence for Kenya and East Africa: mobile money fraud, SIM swap, banking sector attacks, and the regulatory picture. # Kenya Threat Landscape Threat intelligence for Kenya and East Africa, in one place, with sources. Almost all published threat research assumes a North American or European target. The attack surface here is different: mobile money is the financial system, the phone number is the identity layer, and the agent network is where digital value becomes untraceable cash. --- ## The numbers | Metric | Figure | Period | |---|---|---| | Cyber threat events detected | 7.9 billion | first 8 months of 2025 | | Estimated losses to cybercrime | KES 29.9 billion | one quarter, 2025 | | Banking sector fraud cases | 353, up from 153 | 2024 | | Mobile banking losses | KSh 810.68 million, up 344% | 2024 | | Malware incidents | 103 million | 9 months to Sept 2025 | | SIM swap investigations at Safaricom | up 327% | 2025 | Sources are cited in `data/sources.md`. --- ## The threats that matter here **SIM swap.** The phone number is the financial identity. Kenya's High Court recognised this in March 2026 when it restricted arbitrary number recycling. Control the SIM and you control M-PESA, banking OTPs, and account recovery for everything else. **The agent layer.** Hundreds of thousands of agents convert digital value to cash. Every fraud chain ends there, and it is the least monitored part of the system. **Mobile-first malware.** Mobile banking malware rose 1.5x in 2025 while traditional PC banking malware declined. Most enterprise security tooling was built for the Windows endpoint and has no visibility into where the exposure actually is. **Third-party and middleware.** A contractor compromise cost one Kenyan bank over KSh 517 million. Regionally, the Pegasus Technologies breach in Uganda exploited middleware between banks and mobile wallets, moving roughly USD 3 million through around 2,000 SIM cards. The same architecture exists here. **State-sponsored targeting of fintech.** DPRK-linked groups have run confirmed campaigns against cryptocurrency and fintech organisation …