Kenyan organisations are facing a cyber threat environment that looks increasingly similar to what is being seen globally, but the biggest risks are often coming from vulnerabilities and security practices that have been known for years.The latest ESET Threat Report, which analyses threat activity since December 2025 using ESET telemetry and research, suggests that attackers are continuing to rely on familiar techniques such as malicious email attachments, phishing, outdated software and exposed remote desktop services. At the same time, artificial intelligence is becoming increasingly intertwined with the threat landscape, both as a target for attackers and as a tool for developing and carrying out attacks.ESET said it analysed around 900,000 AI skills globally, identifying more than 3,000 that were outright malicious. However, for Kenyan organisations, the more immediate concern may not be emerging AI-driven attacks but the continued effectiveness of conventional techniques.“The threats facing Kenya are the same around the world, and email remains one of the most reliable ways of getting ransomware into the organisation,” says Allan Juma, Lead Cyber Security Engineer at ESET.Malicious email attachments continue to provide attackers with a relatively straightforward way into organisations. According to ESET, scripts accounted for 46.2% of malicious email attachments detected during the reporting period. Microsoft Office documents followed at 14.4%, PDFs at 11.9% and archives at 9.7%.Kenya broadly follows the same pattern, indicating that attackers do not necessarily need highly sophisticated techniques to compromise organisations. Instead, commonly used file formats and social engineering remain effective because employees continue to interact with them as part of their normal work.Another established technique is also becoming more prominent. QR code phishing, commonly known as “quishing”, reached record levels globally during the reporting period. About 11% of detected phishing emails contained a QR code, often directing victims to websites through their personal smartphones. The approach can be particularly useful to attackers because the victim may move from a corporate computer, where security controls are in place, to a personal mobile device that is subject to different protections.In Kenya, ESET telemetry recorded a 145% increase in quishing between the second half of 2025 and the first half of 2026. ESET cautions that the comparison is based on an incomplete baseline and should therefore be viewed as directional rather than a precise measure of growth.Kenya’s overall share of quishing activity remains below that of some major markets. North America, for example, accounted for 12.4% of detections, suggesting that the technique may still have considerable room to expand in Kenya.“QR codes have been adopted everywhere and are a convenience that attackers are counting on,” says Tony Anscombe, Chief Security Evangelist at ESET. “Many people still scan a QR code without stopping to consider where it leads.”Perhaps more significant for Kenyan organisations is the continued exploitation of vulnerabilities that should have been addressed years ago. ESET recorded more than a doubling of exploitation attempts against CVE-2017-0199 in Kenya between the second half of 2025 and the first half of 2026. The vulnerability affects outdated Microsoft Office installations and can allow malicious code to execute when a victim opens a specially crafted document.First disclosed in 2017, CVE-2017-0199 remains among the most frequently detected vulnerabilities globally in ESET’s latest report. It has also reportedly been incorporated into commercially available attack frameworks, including GhostX, which has been sold through dark web marketplaces. Its continued effectiveness in Kenya highlights a problem that extends beyond the vulnerability itself. For organisations running outdated software, an old vulnerability can remain a viable attack route long after security researchers and vendors have identified the weakness and issued fixes.The issue is also reflected in the exposure of remote desktop services. ESET found instances of remote desktop endpoints accessible from the public internet, including systems running versions of Windows that are no longer supported. Such systems can provide attackers with a direct path into an organisation when they have not been properly patched, secured or restricted.“The key takeaway is to do the basics,” says Juma. “Patch your endpoints, protect them at a minimum standard, and stop using default ports and passwords. Too much of what we are seeing comes down to organisations not doing the fundamentals.”The Kenyan threat landscape is also seeing increased activity from malware designed to steal information and deliver additional malicious payloads. ESET telemetry recorded a pronounced increase in Aotera, an infostealer and dropper that has become the fourth most frequently detected malware family in Kenya. Aotera can be used to deliver other malware, including AgentTesla, Formbook, PureLogs, PhantomStealer and Vidar. The connection is significant because the payloads being delivered in Kenya are not isolated threats. They include malware families that are already widely used internationally.
This page contains an attributed headline and the preview text supplied through the publisher’s RSS feed. Copyright in the original reporting belongs to CIO Africa.
