NITDA Warns Nigerians as AI Drives New Wave of Cyber Threats, Launches 2026 Cybersecurity Awareness Campaign

By Simpson Global Media News Desk

Nigeria has begun a month-long national campaign to strengthen cybersecurity awareness as the rapid adoption of artificial intelligence, automated systems and digital services creates new opportunities for criminals to manipulate users and attack online systems.

The National Information Technology Development Agency (NITDA) launched the 2026 National Cybersecurity Awareness Month on October 1 under the theme “Together for a Safer Cyberspace,” calling on individuals, businesses and public institutions to make digital security part of their everyday activities.

The agency said cybersecurity can no longer be treated as the exclusive responsibility of information technology professionals, government agencies or specialised security teams because digital technology now touches virtually every aspect of economic and social life.

In its message marking the campaign, NITDA highlighted emerging threats including AI-assisted social engineering, deepfake impersonation, voice cloning and fraudulent QR-code attacks, commonly known as “quishing.”

The campaign comes as Nigeria continues to expand its digital economy, with banking, payments, government services, communications, commerce, education, healthcare and other activities increasingly dependent on connected systems.

For NITDA, that expansion means the country's cybersecurity posture must develop alongside its digital transformation.

The agency's message is therefore aimed not only at cybersecurity specialists but also at ordinary internet users, employees, entrepreneurs, students, financial customers, public servants and organisations that routinely process information online.

AI Changes the Shape of Cybercrime

Artificial intelligence has become one of the central concerns of the 2026 campaign.

NITDA said the increasing use of AI and automated technologies has changed the cyber-threat environment beyond conventional phishing. Criminals can use increasingly sophisticated techniques to make fraudulent communications appear more convincing, imitate individuals and manipulate digital content.

The agency specifically identified AI-driven social engineering, deepfake impersonation, voice cloning and fraudulent QR-code attacks as emerging areas of concern.

Traditional phishing often depends on an attacker sending a deceptive email or message that attempts to persuade a victim to click a link, reveal a password or transfer money.

The growing availability of AI tools can make those deceptive communications more convincing by allowing criminals to generate polished messages, imitate communication styles or create synthetic audio and visual material.

The result is that users may increasingly have to evaluate not only whether a message looks professional, but whether the underlying request is genuine.

A message appearing to come from a manager, relative, financial institution or business partner may not necessarily have originated from that person or organisation.

NITDA's warning about voice cloning is particularly relevant to an environment in which voice calls and messaging applications are commonly used for personal and business communication.

Synthetic audio can potentially be used to make fraudulent requests appear to come from a familiar voice.

Similarly, deepfake technology can manipulate images or video in ways that make impersonation more difficult to detect through casual observation.

The agency has therefore urged Nigerians to verify suspicious requests rather than relying solely on the apparent identity of the sender or the quality of the communication.

The Growing Importance of Cyber Hygiene

At the centre of NITDA's campaign is the concept of basic cyber hygiene.

The agency's recommendations include using strong and unique passwords, avoiding password reuse and using reputable password-management tools to generate and store complex credentials.

It also recommends enabling multi-factor authentication on personal, professional and financial accounts.

Multi-factor authentication provides an additional verification step beyond a password.

That means a stolen password alone may not be sufficient to gain access to an account where another authentication factor is required.

NITDA has also advised users to install software updates and security patches promptly.

Software updates are sometimes treated as routine inconveniences, but security patches can address vulnerabilities that attackers may otherwise exploit.

For organisations operating large networks, delayed patching can create opportunities for attackers to gain access to systems that contain sensitive information or support essential services.

The agency's recommendations therefore extend beyond individual behaviour to organisational security practices.

Businesses and institutions are expected to ensure that devices, applications and infrastructure are maintained and that access to sensitive systems is properly controlled.

Warning Over OTPs, PINs and Banking Credentials

NITDA has also renewed its warning against sharing sensitive financial information.

The agency specifically advised Nigerians never to disclose one-time passwords, personal identification numbers or online banking login credentials to other people.

The warning is significant because digital financial services have become an important part of everyday transactions.

A customer may receive a message or telephone call that appears to be connected to a bank, payment service or other financial provider.

The communication may claim that an account requires verification, that a transaction has been blocked or that a security problem needs to be resolved immediately.

The urgency can be part of the deception.

NITDA's guidance encourages users to pause, independently verify the request and avoid surrendering confidential authentication information.

The agency also advises people to be cautious about unsolicited links and attachments.

Users are encouraged to check the source of a communication before interacting with it, particularly when a request demands immediate action or involves financial information.

QR Codes Become Another Security Concern

One of the newer issues highlighted by NITDA is the use of fraudulent QR codes.

QR codes are now common in restaurants, payments, advertising, transportation, event registration, websites and other everyday settings.

Their convenience can also create security challenges when users scan codes without knowing where they lead.

NITDA identified fraudulent QR-code attacks, commonly referred to as “quishing”, as part of the evolving threat environment.

A QR code can conceal the destination of a link from the user until it has been scanned.

That makes it important for users to consider the source of the code and examine the destination before providing passwords, financial information or other sensitive details.

The broader lesson from the agency's warning is that familiar technology should not automatically be assumed to be safe.

A QR code can be useful, but the person or organisation distributing it remains an important part of the security equation.

Public AI Tools and Sensitive Information

NITDA has also cautioned Nigerians about the information they submit to public artificial intelligence platforms and unfamiliar online services.

The agency advised users to avoid uploading sensitive personal, financial or proprietary corporate information into public AI models or unfamiliar digital platforms.

The warning reflects a broader challenge created by the rapid spread of generative AI.

Individuals and organisations increasingly use AI systems to draft documents, analyse information, summarise material, generate code and perform other tasks.

However, the convenience of those services does not eliminate the need to consider what information is being submitted.

For an individual, sensitive material could include personal identification information, financial records or private correspondence.

For a company, it could include customer information, confidential contracts, proprietary software code, internal reports or commercial plans.

The security question is therefore not simply whether AI can perform a particular task.

It is also whether the information being supplied to the system is appropriate for that environment.

NITDA's recommendation places responsibility on users and organisations to consider data sensitivity before uploading material to public AI tools.

Social Media Oversharing Can Create Security Risks

The agency has also urged Nigerians to exercise caution about how much personal information they make publicly available on social media.

Information that appears harmless in isolation can sometimes provide useful material for targeted social engineering.

A public profile may reveal a person's workplace, job title, family relationships, birthday, interests, travel plans or other details.

An attacker can potentially combine information from multiple public sources to create a more convincing fraudulent message.

NITDA therefore recommends responsible social-media use and warns that excessive disclosure can make targeted attacks easier.

The issue illustrates why cybersecurity increasingly involves human behaviour as well as technical systems.

Even a well-protected organisation can face risks if an employee is persuaded to reveal credentials or authorise a fraudulent transaction.

Likewise, a person can have a strong password and still be vulnerable if an attacker convinces them to surrender a verification code.

Cybersecurity awareness is therefore intended to improve decision-making at the point where people interact with digital systems.

Backups and Ransomware Recovery

NITDA has also recommended regular offline and cloud backups of important personal and organisational information.

Backups can play an important role in recovery following ransomware attacks, system failures or other disruptions.

Ransomware typically involves attackers restricting access to data or systems and demanding payment in exchange for restoring access.

A reliable backup strategy can give an organisation another route to recovery.

NITDA's recommendation specifically calls for maintaining offline and cloud backups of critical information.

The distinction is important because a backup connected continuously to an affected network may itself become inaccessible or compromised during an attack.

For businesses and government institutions, backup planning should therefore be part of broader continuity and disaster-recovery arrangements.

The objective is not simply to possess copies of information but to ensure that those copies can actually be recovered and used when needed.

Cybersecurity Becomes a National Digital-Economy Issue

Nigeria's cybersecurity challenge is closely connected to the country's wider digital transformation.

As more transactions and public services move online, disruption to digital systems can have consequences beyond the technology sector.

Banks depend on digital networks to process transactions.

Telecommunications companies operate infrastructure supporting communications and internet access.

Government institutions increasingly rely on online platforms for public services and administrative processes.

Businesses use cloud systems, payment platforms, websites and digital communications to operate.

Healthcare providers increasingly depend on electronic information systems.

Educational institutions also use online platforms for teaching, administration and communication.

This means that cybersecurity is becoming part of the infrastructure supporting economic activity.

NITDA's decision to frame the 2026 campaign around shared responsibility reflects that reality. The agency said securing Nigeria's digital landscape requires the participation of citizens, businesses and institutions rather than relying exclusively on technical specialists.

Government Systems and Critical Infrastructure

The importance of cybersecurity extends further to systems that support essential public and economic functions.

Nigeria's cybersecurity institutions have previously warned about threats involving phishing, ransomware, business email compromise, data breaches and exploitation of unpatched systems.

The Nigeria Computer Emergency Response Team, or ngCERT, has described high-impact cyber incidents affecting organisations across multiple sectors and has urged organisations to strengthen controls including multi-factor authentication, endpoint monitoring, patching, least-privilege access and staff training.

The same advisory identified financial services, telecommunications, government institutions, healthcare and other critical infrastructure as sectors where data sensitivity and system availability are particularly important.

Although NITDA's October awareness campaign is focused heavily on public behaviour, the broader cybersecurity environment demonstrates why institutional preparedness is also necessary.

Cybersecurity cannot depend entirely on users recognising fraudulent messages.

Organisations must also build systems that limit the damage when mistakes occur.

That can include restricting access privileges, monitoring networks, segmenting sensitive systems, maintaining secure backups and having procedures for reporting and responding to incidents.

From Awareness to Incident Response

Awareness is only one part of cybersecurity.

When an incident occurs, speed can become important.

NITDA said its Computer Emergency Readiness and Response Team, CERRT.ng, remains involved in cybersecurity awareness, incident-response support and the provision of guidance to citizens and organisations.

The agency has encouraged members of the public to follow its official updates and cybersecurity advisories.

For incidents and inquiries, NITDA's campaign information directs members of the public to CERRT.ng, including its reporting channels.

An effective response process can help organisations identify what happened, contain an incident, preserve relevant evidence, restore affected services and reduce the possibility of a repeat occurrence.

For companies, incident response should also be connected to internal management structures.

Cybersecurity incidents can involve legal, financial, operational and communications consequences, meaning that responsibility cannot necessarily rest solely with an IT department.

Why Employees Remain Important

Employees remain a central element of organisational cybersecurity.

An attacker may target a technical vulnerability, but many campaigns also attempt to persuade people to take an action that benefits the attacker.

A fraudulent invoice, password-reset message, urgent executive request or fake technical-support communication can all be designed around human decision-making.

NITDA's emphasis on suspicious links, unsolicited requests, synthetic audio and deepfake content reflects this changing environment.

Training therefore becomes an important component of organisational security.

Employees need to know how to recognise suspicious communication, where to report it and what to do if they have already clicked a link or disclosed information.

An organisation that encourages rapid reporting can potentially identify an incident earlier than one in which employees fear disciplinary consequences for reporting mistakes.

The Challenge for Small Businesses

The cybersecurity conversation also extends to small businesses.

Large companies may have dedicated security teams, security monitoring systems and formal incident-response arrangements.

Small businesses often operate with fewer technical and financial resources.

Yet they may still handle customer information, payment details, employee records and commercially sensitive information.

A small company may also rely heavily on cloud email, online banking, social media accounts, digital advertising and messaging applications.

NITDA's recommendations on passwords, multi-factor authentication, software updates, data protection and backups are therefore applicable beyond large enterprises.

For smaller organisations, basic controls can form the foundation of a broader security programme.

Separating business and personal accounts, using multi-factor authentication, limiting administrative privileges and maintaining reliable backups can reduce exposure without requiring a large security operation.

AI Brings Both Risk and Opportunity

The relationship between AI and cybersecurity is not limited to criminal use.

Artificial intelligence can also be used defensively.

Security teams can use automated systems to analyse large quantities of information, identify unusual activity, detect patterns and support incident response.

The challenge is that defenders and attackers can both benefit from advances in automation.

That creates an environment in which cybersecurity teams need to keep adapting as threat techniques change.

NITDA's campaign does not call for avoiding AI altogether.

Instead, its guidance focuses on responsible use, particularly around the information users submit to public AI systems and unfamiliar online services.

That distinction is important for Nigeria's technology sector as businesses, government agencies and individuals increasingly explore AI applications.

Digital innovation and cybersecurity therefore need to develop together.

Building a Security Culture

The phrase “Together for a Safer Cyberspace” places emphasis on collective responsibility.

For individuals, that can mean refusing to disclose authentication information, verifying suspicious requests and keeping devices updated.

For businesses, it can mean enforcing stronger access controls, training employees, protecting customer information and maintaining recovery plans.

For public institutions, it can mean securing government systems and ensuring that digital public services are resilient.

For technology companies, it can mean building security into products and services rather than treating it as an additional feature after deployment.

The approach also requires awareness to continue after October.

Cyber threats do not operate according to an awareness calendar.

New vulnerabilities can emerge at any time, while criminal groups can change tactics as technology develops.

The month-long campaign can therefore serve as a starting point for practices that need to continue throughout the year.

International Cybersecurity Conference Ahead

Nigeria is also preparing for a major cybersecurity gathering later in October.

The National Information Technology Development Agency's event calendar lists the International Cybersecurity Conference 2026, scheduled for October 27 and 28 in Abuja.

The related 2026 conference programme describes a 48-hour cybersecurity hackathon with six challenge tracks and a prize pool of more than ₦10 million, alongside opportunities for participants to develop solutions addressing digital-economy and cyber-defence challenges.

The conference and hackathon provide another platform for discussions around cybersecurity capacity, technical innovation and digital resilience.

They also highlight the growing importance of developing local expertise as Nigeria's digital infrastructure expands.

Cyber Skills and the Next Generation

The country's cybersecurity needs are likely to increase as more organisations adopt cloud services, artificial intelligence, connected devices and digital platforms.

That creates demand not only for security products but also for people who understand how to design, monitor and protect digital systems.

Skills in areas such as network security, cloud security, incident response, digital forensics, application security, identity management and security operations can become increasingly important to organisations operating in a digital environment.

Awareness campaigns can help create the first layer of understanding, but a sustainable cybersecurity ecosystem also requires education, professional training, research and practical experience.

Nigeria's technology sector therefore faces two related tasks: protecting the systems already in use and developing the human capacity needed to secure future systems.

Protecting Data in an Expanding Digital Economy

The issue of data protection also sits alongside cybersecurity.

As businesses and government institutions collect more digital information, the potential consequences of unauthorised access can increase.

Personal information can be used for identity-related fraud.

Financial information can expose customers to losses.

Corporate information can create commercial or competitive risks.

Government information may involve public administration or sensitive national systems.

NITDA's warning about uploading sensitive information into public AI tools is therefore part of a wider principle: users need to understand what information they are sharing, with whom and for what purpose.

Technology can make information easier to process and share, but it can also make mistakes easier to scale.

What Nigerians Can Do

For individual users, NITDA's recommendations provide a practical starting point.

People should use different strong passwords for important accounts rather than reusing one password across multiple services.

Multi-factor authentication should be activated wherever it is available, particularly for email, financial and professional accounts.

Software and operating systems should be updated when security patches are released.

One-time passwords, PINs and banking credentials should remain private.

Suspicious links, attachments and unexpected requests should be independently verified before users respond.

People should be careful about the information they make public on social media.

Sensitive personal, financial and corporate information should not be casually entered into public AI tools.

Important files should be backed up in ways that allow recovery if a device is lost, damaged or compromised.

And when something suspicious happens, users should report it rather than simply ignoring the incident.

These measures cannot eliminate cyber risk, but they can reduce opportunities for common forms of attack.

What Organisations Need to Consider

For organisations, the challenge is broader.

Cybersecurity should be incorporated into business planning rather than treated only as a technical problem.

Access should be limited according to job requirements.

Sensitive systems should receive additional protection.

Critical data should be backed up and recovery procedures tested.

Employees should receive regular awareness training.

Security incidents should have clearly defined reporting channels.

Software and hardware should be patched and monitored.

Organisations should also know which external service providers have access to their systems and information.

These measures become particularly relevant as companies increasingly depend on cloud computing and third-party digital platforms.

The security of a digital business can depend partly on the security practices of its technology suppliers.

A More Complicated Digital Environment

Nigeria's digital transformation is creating substantial opportunities for commerce, public services, innovation and communication.

At the same time, the expansion of digital activity creates a larger environment in which cybercriminals can operate.

NITDA's 2026 campaign reflects that changing balance.

The agency is asking Nigerians to treat cybersecurity as an everyday responsibility rather than a specialist concern reserved for technology departments.

The emphasis on AI-driven social engineering, deepfakes, voice cloning and QR-code fraud shows how quickly the techniques used to manipulate users can evolve.

The practical response remains rooted in several familiar principles: verify before trusting, protect credentials, use stronger authentication, update devices, limit unnecessary disclosure and maintain recoverable copies of important data.

Those principles may appear simple, but their consistent application across millions of users and thousands of organisations can form an important layer of national digital resilience.

The Road Ahead

The 2026 National Cybersecurity Awareness Month will continue throughout October, giving government agencies, businesses, technology professionals and citizens an opportunity to focus attention on digital safety.

NITDA's campaign comes at a time when Nigeria is simultaneously expanding digital services and exploring increasingly sophisticated technologies, including artificial intelligence.

That combination makes cybersecurity a continuing part of the country's technology agenda.

The central question is no longer simply how quickly Nigeria can adopt new digital tools.

It is also how securely those tools can be deployed, operated and used.

For individuals, that means making safer choices when handling digital accounts and information.

For businesses and institutions, it means building stronger security into everyday operations.

For technology developers, it means considering security and privacy during product design.

And for government, it means continuing to develop the institutions, standards, skills and response mechanisms required to protect a growing digital economy.

NITDA's message for October is therefore broader than a month-long awareness exercise. It is a call for cybersecurity practices to become part of normal digital behaviour.

As artificial intelligence and other emerging technologies continue to change how Nigerians work, communicate, transact and access services, the ability to recognise and manage digital risks will remain an important part of the country's technological development.

The agency's theme — “Together for a Safer Cyberspace” — captures the central challenge: Nigeria's digital future will depend not only on the technologies it adopts, but also on the systems, skills and everyday habits used to protect them.