Cybercriminals copy top African brands like DStv to trick users into downloading bad apps that steal banking cash.
Cybercriminals are sending deceptive messages across Africa to trick everyday smartphone owners into installing dangerous software that steals money directly from bank accounts.
Online scammers are creating fake copies of popular brands, such as the TV provider DStv, the shopping platform Takealot, the airline South African Airways, and national tax offices.
Unsuspecting victims receive messages containing tempting job offers, tax refund notices, or account updates that direct them to fake websites designed to look like official company portals.
Once on these web pages, users are asked to download a hidden application that silently infects their mobile phones and monitors private banking activities.
The cybersecurity alert was officially published on August 20, 2026, following detailed research from international digital safety company NordVPN.
See Also: Texas College Student Exposes Rogue AI Hacking Attempt on Open Source Code
Investigators discovered that the crime network has been active since August 2025, using over 100 fake websites to trick citizens across South Africa and surrounding regions.
By building realistic web pages using disposable domain names and smart artificial intelligence translation tools, scammers easily trick ordinary internet users into downloading harmful mobile files.
The main reason for this widespread scam campaign is that modern banks send security codes, called one-time passcodes, via text message to confirm money transfers.
Once a victim downloads the fake application, the hidden virus gains permission to read text messages, log key taps, and record phone screens.
When bank security codes arrive via text message, the bad software intercepts the numbers and sends them straight to the criminals. This allows thieves to unlock mobile banking apps, authorize illegal money transfers, and empty personal savings accounts without triggering standard bank alarms.
Explaining how the sneaky software bypasses bank security checks, cybersecurity researchers at NordVPN stated, “The malware effectively neutralises two factor authentication”.
Detailing how thieves log into personal accounts to complete illegal transactions, NordVPN experts added that “attackers can log into the victim’s banking app and approve the transaction themselves”.
Warning citizens never to click links or download software attached to urgent text messages, NordVPN Chief Technology Officer Marijus Briedis urged smartphone users never to install apps from links received in messages and to treat extreme urgency as a clear warning sign of fraud.
By learning how these digital traps operate, everyday phone users can protect their hard-earned money from online thieves. Staying safe requires downloading applications only from official app stores, ignoring unexpected text links, and contacting banks immediately if a phone begins acting strangely.
About the Author
Jennifer Sakmufuwo Baba is a tech analyst, senior staff, and writer covering artificial intelligence, cybersecurity , and emerging technologies at TechRegard. Based in Nigeria, she's passionate about translating complex tech developments into compelling, accessible stories for diverse audiences. Her work focuses on how technology shapes innovation across Africa and globally.
