Experts say ransomware attacks often begin long before ransom demands are issued.
Picture: iStock
South Africans are being urged not to let their guard down online as cybercriminals continue to exploit phishing scams, identity theft, fraudulent links, and deepfake technology to target unsuspecting victims long after Cybersecurity Awareness Month has ended.
The warning comes as South Africa remains a major cybercrime hotspot on the continent. According to Interpol’s 2026 African Cyberthreat Assessment Report, the country accounts for 92% of ransomware detections in Africa.
Cybersecurity
Experts say ransomware attacks often begin long before ransom demands are issued, with hackers gaining access through stolen passwords, infostealer malware, or unpatched devices such as routers and VPNs.
Cybersecurity firm Fortinet has also reported a sharp rise in infostealer malware, which quietly harvests saved passwords, login sessions, and sensitive information from infected devices.
South Africa accounted for 43.6% of exploitable vulnerabilities detected across Africa in 2025, with criminals increasingly exploiting software flaws within 24 to 48 hours of disclosure.
Online safety
The Department of Communications and Digital Technologies (DCDT) and the Film and Publication Board (FPB) have warned that the growing threat of cybercrime requires constant vigilance from internet users.
The department said online safety cannot be confined to a single month-long awareness campaign.
“Online threats such as phishing, identity theft, fraudulent links, deepfake incidents, and unauthorised access to personal information continue to highlight the importance of digital vigilance.”
The DCDT stressed that cybersecurity is a shared responsibility, not solely the task of government, technology specialists, or law enforcement agencies.
“The DCDT and the FPB emphasise that cybersecurity is not solely the responsibility of government, technology experts, or law enforcement agencies. It is a shared responsibility that requires the active participation of every individual who accesses and uses digital platforms.”
Simple mistakes
The department warned that seemingly harmless actions, such as clicking on suspicious links, sharing one-time passwords (OTPs) or reusing weak passwords across multiple accounts, can expose users to fraud and financial loss.
“You do not have to be a cybersecurity expert to protect yourself online, but rather consistent and responsible digital habits make a difference.”
Risk
To reduce risk, South Africans are encouraged to use strong passwords, activate two-factor authentication, verify messages before responding, and keep devices and software up to date.
The DCDT said cybercriminals often exploit human error rather than technical weaknesses, making awareness one of the most effective forms of protection.
Experts also urge individuals and businesses to enable multi-factor authentication, avoid saving work credentials on shared devices and prioritise software updates to reduce the risk of cyberattacks.
Cybersecurity
The department said building a safe digital environment requires the participation of individuals, families, businesses, schools and institutions.
“We want South Africans to understand that they have the power to make life more difficult for cybercriminals. Something as simple as not sharing your OTP, using a strong password, verifying information before sending money or thinking twice before clicking a link can prevent serious financial and personal harm.”
As South Africa advances its digital transformation agenda, the DCDT said continued public education and responsible online behaviour will remain critical to protecting personal information and strengthening the country’s cybersecurity resilience.
“As Cybersecurity Awareness Month concludes, the message is clear: cybersecurity is everyone’s responsibility, every day. Let us turn awareness into action and work together towards a safer and more secure digital South Africa.”
Interpol warning
South Africa’s dominance in Africa’s ransomware statistics underscores the growing sophistication of cybercriminals targeting individuals, businesses and institutions.
Experts warn that ransomware attacks frequently start with stolen passwords, compromised login credentials and vulnerable internet-facing devices, allowing criminals to infiltrate systems long before victims realise they have been breached.
Malware
Fortinet found a significant increase in infostealer malware, which silently steals passwords, banking details, login sessions and other sensitive information from infected devices.
With attackers now exploiting newly disclosed vulnerabilities within days, cybersecurity experts warn that strong passwords, multi-factor authentication, and regular software updates remain among the most effective defences against online threats.
