GhostGPT. Digital criminal for hire.
GhostGPT isn’t a Silicon Valley experiment. It’s a criminal chatbot for hire. Marketed on underground forums, the tool wraps jailbroken AI models and gives fraudsters a quick way to spin up malware, phishing emails or fake login pages that look convincing enough to trick even savvy employees. Unlike a cut-and-paste kit, GhostGPT will “improve” its output until the code runs.
For Southern Africa, this is a huge problem. The region has been ground zero for business email compromise, mobile wallet fraud and cross-border scams for years. Now, with a tool like GhostGPT, the skill barrier drops for bad actors. A small team with little technical expertise can use AI to craft phishing messages in fluent English, French or Swahili, and then package them in portals that are cloned from real banks or telcos.
The numbers behind the story
Interpol’s latest regional operation shows just how industrialised cybercrime has become. Between June and August this year, investigators across 25 African countries arrested 1,209 suspects and recovered about $97.4 million linked to online fraud, mobile money theft and business email compromise (Interpol press release).
Threat reports echo the same picture. Fortinet’s 2025 Global Threat Landscape Report logged a 42% rise in stolen credentials year-on-year and more than 97 billion exploitation attempts globally (Fortinet 2025 report). Stolen passwords and tokens are precisely what GhostGPT-style attacks aim to capture. Meanwhile, Thales’ Critical Infrastructure Data Threat Report highlights that 56% of security leaders cite secrets management — handling passwords, keys and tokens — as their top DevOps challenge (Thales report). In simple terms: companies are struggling to safeguard the very credentials GhostGPT makes it easier to steal.
Why it resonates in Africa
The African market has two dynamics that make this especially scary. First, mobile finance. Wallets, micro-loans and agent banking have leapfrogged traditional systems, but their protection often rests on basic SMS or app logins. A spoofed landing page or carefully worded phishing SMS, now polished by GhostGPT, can steal credentials at scale.
Second, uneven capacity. Interpol notes that 90% of African countries still need major improvements in law enforcement or prosecution capacity for cybercrime. That gap means incidents will often go unreported or unresolved, giving fraudsters more room to experiment.
What businesses can do now
GhostGPT may be new, but the defences are not:
- Identity is the frontline. Move critical services to phishing-resistant multi-factor authentication and cut off legacy email protocols that bypass it.
- Filter and flag. Invest in email and DNS filtering, and watch for red-flag activity like logins from unusual geographies or first-time admin actions.
- Educate locally. Front-line staff at banks, mobile-money agents and SMEs are often the first targets. Training that covers real-world scenarios pays off quickly.
The bottom line
GhostGPT doesn’t reinvent cybercrime. It accelerates it. By lowering the barrier to professional-grade phishing and malware, it adds speed and scale to scams already affecting African businesses and consumers. The technology gap is shrinking, but so are the excuses for weak credential controls. The challenge now is to make sure African organisations don’t become the easiest testing ground for AI-enabled fraud.