Kaspersky Alerts Facebook Users to New StealC v2 Malware Campaign Targeting Africa

Cybersecurity experts at Kaspersky have uncovered a new wave of cyberattacks targeting Facebook users across Africa, warning that the malicious campaign is designed to steal login credentials, personal data and even cryptocurrency wallet information.

Since late August 2025, the Kaspersky Global Research and Analysis Team (GReAT) has detected more than 400 incidents involving the StealC v2 infostealer. Confirmed cases have been reported in Kenya, Angola, Ethiopia, Niger, Uganda, Zambia and several other African countries.

The malware is being distributed through Facebook messages containing links disguised as official account notifications. Victims receive a message claiming their account has been blocked due to suspicious activity. Clicking the link directs them to a fake support page, where they are urged to “Appeal” the restriction. This triggers the download of a malicious script that installs StealC v2 onto the device.

Once active, the malware extracts passwords, cookies, screenshots, and cryptocurrency wallet details, posing serious risks to both individual users and businesses.

“Cybercriminals often exploit users’ fear of losing account access and a perceived sense of urgency. This pressure can lead individuals to act without caution, increasing the risk of infection by malware such as StealC v2. Users should remain vigilant and always verify the authenticity of messages before clicking any links,” said Marc Rivero, Lead Security Researcher at Kaspersky’s Global Research and Analysis Team.

StealC first appeared on the dark web in 2023 and rapidly became popular among cybercriminals due to its accessibility and effectiveness. The newly updated StealC v2 significantly expands its capabilities, making it even more dangerous for users.

Kaspersky has advised both individuals and organisations to remain alert to phishing attempts. Recommended security measures include:

• Exercise caution before clicking links: Fake emails and websites may appear legitimate but often contain spelling errors or misleading redirects.

• Be wary of urgency tactics: Phishing attacks commonly pressure victims into immediate action, such as resetting passwords or sharing sensitive information.

• Verify unexpected messages: Always confirm unsolicited messages, calls, or links - even those that look genuine. Never disclose two-factor authentication codes.

• Use trusted security solutions: Employ advanced cybersecurity tools to block phishing attempts and safeguard data.