A cyberattack investigation shows that criminals are using artificial intelligence to take control of compromised education networks in Africa. The problem goes beyond using AI to write phishing messages. Attackers are using AI agents to direct technical activity after gaining access to an organisation’s systems.
Kaspersky reported on November 2 that researchers identified attacks against educational organisations in Africa and Latin America between September and October 2026. CyberStrikeAI is an open-source framework connecting a command-and-control server to a large language model, which the attackers used. A human operator sets an objective; the model selects tools, generates commands and analyses results from compromised computers.
In one intrusion, Kaspersky said attackers reached domain-administrator accounts within three to four days of deploying the CyberStrikeAI agent. The final stage, involving movement between computers, credential collection and database export, took less than an hour. The company did not identify the countries or institutions, or say what the exported database contained. The findings do not establish that student records were stolen.
The Shift Happens After Hackers Get In
AI did not break into this target system independently. Kaspersky describes an initial SQL Server compromise and preparation before CyberStrikeAI helped direct activity inside the network. The technology reduced the step-by-step work required from the human operator.
This means that familiar weaknesses should be taken more seriously. Stolen passwords, excessive administrator privileges, unpatched servers and poor monitoring can let intruders move between systems. AI can accelerate those actions, but it does not remove the weaknesses.
Nigeria’s Growing Digital Education Footprint
Nigeria is expanding the education information managed through digital platforms. The Federal Ministry of Education’s Digital National Education Management Information System includes a learner registry for maintaining records across states and local government areas.
There is no evidence that this Nigerian platform was involved in the attacks. Its development shows why security must be built into education technology. As records become connected, institutions need strict access controls, audit logs, backups and incident-response responsibilities.
INTERPOL’s African Cyberthreat Assessment Report 2026 says that AI is responsible for 55% of reported cybercrimes across Africa, based on information from 36 member countries. The figure is not specific to schools, but highlights the wider threat environment.
What Institutions Should Strengthen
Schools, universities and education agencies need more than antivirus software. They should enforce multi-factor authentication, separate administrator accounts, update software, restrict database access, keep offline backups and monitor network activity.
Institutions should isolate affected systems, preserve evidence and notify students, staff and regulators. Smaller schools may need shared incident-response support where security teams are unaffordable.
Back Story
Education attracts cybercriminals because institutions hold information and rely on systems for admissions, examinations, payroll and teaching. Sophos’ 2025 study of 441 education organisations in 17 countries found phishing was an entry route in 22 per cent of ransomware incidents in lower education. Exploited vulnerabilities accounted for 35 per cent in higher education. Sophos
The Kaspersky investigation shows how AI is changing attackers’ work after they gain access. Institutions must detect intruders moving across networks, not merely block a suspicious email or login, and recover quickly.
Also Read: AI-Powered Cyberattacks Threaten Nigeria’s Financial Institutions as NCC Raises Alarm
