Kenya has spent years building one of Africa’s most celebrated digital economies. Mobile money transformed how millions of people transact, fintech widened access to financial services, businesses moved more operations online, and government services increasingly migrated into digital platforms.
But the same transformation that has made Kenya a regional technology leader is creating a larger and more valuable attack surface for criminals.
That is the uncomfortable message from the 2026 INTERPOL African Cyberthreat Assessment Report, which examines cybercrime trends across the continent in 2025.
Its findings place Kenya at the centre of an East African cyberthreat environment increasingly defined by mobile-money fraud, attacks on digital infrastructure and the exploitation of weaknesses in identity verification.
The numbers are difficult to dismiss. Kenya recorded more than 46,786 distributed denial-of-service (DDoS) attacks in the first half of 2025, targeting telecommunications infrastructure.
Between July and September, the Communications Authority of Kenya reported hundreds of millions of intrusion attempts against government and ICT infrastructure, principally through brute-force attacks and exploitation of system vulnerabilities.
Then there is the problem that is arguably closer to ordinary Kenyans: the mobile phone.
INTERPOL reports that SIM-swap fraud in Kenya surged by 327 per cent in 2025, with more than 123,000 fraudulent SIM cards issued and an estimated US$3.8 million drained from mobile wallets.
The report identifies East Africa as a hub of mobile-money fraud precisely because the region’s enormous digital financial ecosystem has become attractive to criminals.
This is more than a telecoms problem. In a country where a mobile number can function as a gateway to money, banking, identity, business and government services, compromising a SIM can potentially mean compromising an entire financial ecosystem.
The report’s wider African findings make the point even more starkly. Mobile-money fraud was the most prevalent scam reported by the countries surveyed, appearing in 97 per cent of responding countries.
INTERPOL links the problem to weaknesses in Know Your Customer systems and, particularly, the inability of some telecom operators to verify identity in real time.
Kenya, therefore, faces a paradox. The country’s digital infrastructure has made financial inclusion faster and more convenient, but the concentration of services around digital identities and mobile devices means that a weakness in one layer can have consequences across several others.
The threat is also becoming harder to detect because cybercrime is no longer simply about a hacker breaking into a computer. Criminals are increasingly exploiting people, trust and identity.
INTERPOL says artificial intelligence became a core operational driver of cybercrime in Africa in 2025. AI is being used to generate highly personalised phishing messages, create synthetic identities, bypass KYC systems and produce malware capable of adapting to conventional security measures.
Across Africa, 55 per cent of cybercrime cases in the survey involved AI in some capacity.
For Kenya, the implications are particularly serious because the country’s digital economy is so deeply embedded in everyday life.
A convincing message that appears to come from a bank, employer, government agency, family member or business partner does not need to defeat a sophisticated firewall if it can persuade a human being to hand over the information required to defeat the system from the inside.
The report’s findings on sextortion offer another illustration of how the threat is changing. TrendAI recorded 600,000 sextortion detections across Africa in 2025, with Kenya accounting for 13 per cent, second only to South Africa’s 30 per cent.
The campaigns were predominantly delivered through the Phorpiex botnet and used threats of releasing intimate content to extort cryptocurrency payments. Yet Kenya is not portrayed simply as a country losing the cybercrime race.
Indeed, one of the more revealing findings is that Kenya accounted for only 1 per cent of Africa’s ransomware detections in 2025, compared with 92 per cent for South Africa.
The Kenyan challenge is therefore not best understood as a single ransomware crisis. It is a broader ecosystem of fraud, identity compromise, phishing, DDoS attacks and attacks on digital infrastructure.
That distinction matters because it changes what cybersecurity should mean.
The answer cannot simply be more firewalls, more passwords or more awareness posters. INTERPOL identifies a deeper problem across Africa: the systems responsible for detecting and responding to cybercrime often do not communicate quickly enough with one another.
Banks, telecom companies and law enforcement may each possess part of the evidence needed to stop a fraud, but information-sharing mechanisms can be slow, fragmented or dependent on legal processes that take too long.
Kenya’s response will therefore have to move beyond protecting individual networks towards protecting the connections between systems.
That means faster mechanisms for banks, telecom operators and investigators to share fraud intelligence; stronger real-time identity verification; better protection of government and critical infrastructure; stronger digital-forensics capacity; and a regulatory environment capable of responding to criminals who can move across borders much faster than institutions can.
INTERPOL notes that Kenya’s cybercrime reforms have specifically targeted SIM swaps and scam calls, while the country’s “Kaa Chonjo!” awareness campaign has focused on practical measures such as not sharing one-time passwords or PINs.
But the larger lesson from the report is that cybersecurity can no longer be treated as a specialist concern for IT departments. For Kenya, it is becoming a question of economic infrastructure.
The more Kenyans depend on mobile money, digital banking, online government services, telecommunications and digital identities, the more valuable those systems become to criminals.
The country’s digital success has created an economy that is faster, more connected and more convenient. It has also created an economy in which a compromised phone, stolen identity or successful phishing message can travel much further than it once could.
The next phase of Kenya’s digital transformation will therefore require something more than innovation. It will require trust that the systems underpinning that innovation can withstand the criminals trying to exploit them.
