Kenya is losing billions of shillings each year to cybercrime as attackers increasingly shift focus from large organisations to individuals, exploiting social media, deepfakes and high-reach digital platforms.
Experts say the change has made cybercrime more widespread, faster to execute and significantly harder to control.
In recent years, companies have strengthened their cybersecurity systems and invested heavily in early detection, making traditional corporate breaches more difficult. As a result, cybercriminals are adopting new strategies that prioritise scale, speed and accessibility over technical complexity.
According to ESET engineer Allan Juma, attacks previously targeted banks, telecom firms and government institutions through ransomware and network breaches. That model, he says, has now evolved.
“Attackers are no longer just going after companies. They are now targeting the masses because that’s where the money is,” Juma explained.
Recent findings show a growing trend of scams aimed at individuals, driven by the rapid expansion of social media and digital financial services. Among the most prominent are investment scams promising quick returns, often promoted through hacked or impersonated accounts of public figures.
A notable example involved the compromised account of Raila Odinga, which was used to promote a fraudulent cryptocurrency scheme using AI-generated deepfake videos.
Data from the Communications Authority of Kenya estimates cybercrime losses at approximately Sh4.6 billion as of December 2025, underscoring the growing financial impact.
Analysts say cybercriminals are now operating like digital marketers—optimising for reach, engagement and conversion. By targeting large audiences, even small individual losses can quickly accumulate into billions.
While Kenya’s digital growth signals progress, experts warn it also exposes more users to evolving cyber threats.
