Cybercriminals Target South Africans via Smartphone Scams

Cybercriminals are executing a sophisticated campaign in South Africa, impersonating well-known brands such as DStv, Takealot, and South African Airways to steal bank account information. According to cybersecurity firm NordVPN, the operation has been active since at least August 2025 and involves the distribution of Remote Access Trojans (RATs) and banking trojans.

These forms of malware allow criminals to gain control over infected devices and access sensitive information. The attacks typically start with social engineering tactics, where victims receive convincing messages via SMS, WhatsApp, or social media, often featuring urgent offers or requests.

These messages direct users to fake websites that mimic legitimate organizations, encouraging them to download malicious Android applications. Once installed, the malware can quietly operate in the background, intercepting SMS messages, including one-time passwords (OTPs), which undermines banking security.

NordVPN has identified over 100 domains linked to this campaign, which frequently change to avoid detection. Marijus Briedis, a chief officer at NordVPN, advises users against installing applications from unsolicited messages and to be cautious of urgent requests.