The Phishing Kit Market Has Discovered African Banking — and It Is Localizing Fast

A phishing kit sold on two criminal forums for $340 a month now includes convincing clones of 40 African banking and wallet interfaces, real-time one-time-password relay, and a dashboard that shows the operator each victim's session as it happens. It also comes with a support channel that answers questions within the hour.

The localization is the notable part. Earlier generations of kits were translated poorly and cloned interfaces that African customers had never seen. The current crop gets the details right: correct bank fonts, correct transaction limits shown in the fake confirmation screens, correct USSD strings on the fallback flow. Afrikons reviewed screenshots of two kits provided by a researcher who monitors the forums.

"The economics changed, that is all," said a researcher at a regional CERT who requested anonymity because of the nature of the monitoring. "Two years ago cloning a Kenyan bank was not worth a developer's time. Now there is enough money moving through these apps that it is a product line, and it has a roadmap."

Banks are responding with device binding and behavioral signals, which raise the operator's cost without eliminating the attack. The more uncomfortable finding in the research is how the traffic arrives: the majority of victims in the sampled campaigns reached the fake page through a paid search advertisement for their own bank's name.