Old security flaws expose Kenyan organisations to rising cyberattacks

Tony Anscombe, Chief Security Evangelist at cybersecurity firm ESET.

Kenyan organisations are being targeted mostly through old, avoidable weaknesses rather than new or advanced techniques, a new report by cybersecurity firm ESET has found.

Attacks targeting a Microsoft Office weakness first identified nine years ago, known as CVE-2017-0199 (Common Vulnerabilities and Exposures), more than doubled in Kenya between the second half of 2025 and the first half of 2026, ESET’s data shows.

The flaw allows malicious code to run when a victim opens a specially designed document. ESET says the vulnerability has been incorporated into off-the-shelf attack frameworks such as GhostX, which are sold on dark web marketplaces.

QR (Quick Response) code phishing, known as “quishing”, also jumped 145 per cent in Kenya over the same period. ESET cautions that the figure should be treated as directional because the comparison is based on an incomplete baseline.

Globally, about 11 per cent of phishing emails detected during the reporting period carried a QR code. The technique often redirects victims to their mobile phones, potentially taking them outside the security controls protecting their work computers. Kenya’s share remains below North America’s 12.4 per cent, suggesting the technique has room to grow locally.

“QR codes have been adopted everywhere and are a convenience that attackers are counting on,” said Tony Anscombe, ESET’s chief security evangelist. “Many people still scan a QR code without stopping to consider where it leads.”

Email remains another major route into organisations, with malicious attachments continuing to be used to deliver ransomware and other threats.

“The threats facing Kenya are the same around the world, and email remains one of the most reliable ways of getting ransomware into the organisation,” said Allan Juma, ESET’s lead cybersecurity engineer.

Globally, scripts accounted for 46.2 per cent of malicious email attachments analysed by ESET, followed by Microsoft Office documents at 14.4 per cent, PDFs (Portable Document Format) at 11.9 per cent and compressed archive files at 9.7 per cent.

A malware family known as Aotera, which can steal information and deliver other malicious programmes, has become the fourth most frequently detected malware family in Kenya. It has been used to deliver threats including AgentTesla, Formbook, PureLogs, PhantomStealer and Vidar.

Juma also pointed to remote access systems exposed to the internet, with some running unsupported versions of Windows and lacking adequate security hardening.

“The key takeaway is to do the basics,” Juma said. “Patch your endpoints, protect them at a minimum standard, and stop using default ports and passwords. Too much of what we are seeing comes down to organisations not doing the fundamentals.”

Some Kenyan organisations have also responded to incidents they believed were ransomware attacks when no genuine ransomware was present, according to Juma.

“Organisations need to understand what ransomware is and how to verify a genuine attack before they respond to one,” he warned.

The Kenya findings form part of ESET’s H1 2026 Threat Report, which examines changes in the cyber threat landscape since December 2025.

Globally, the report also examined about 900,000 AI (Artificial Intelligence) skills and found more than 3,000 to be outright malicious, reflecting the growing use of AI as both a target and a tool for cyberattacks.