The National Information Technology Development Agency (NITDA) has issued a public advisory warning about a newly discovered malware called “CovertCatch.”
The agency alerted the public that the malware, spread by cyber threat actors through LinkedIn, poses significant risks to individuals and organizations across various sectors, including defense, media, technology, and academia.
In a statement released in Abuja on Tuesday, NITDA’s Director of Media and Corporate Communications, Mrs. Hadiza Umar, highlighted the deceptive tactics used by attackers, stating, “By posing as recruiters or job opportunity providers, these cyber threat actors trick users into downloading malicious files or clicking harmful links.”
She warned that CovertCatch has been designed to infiltrate networks by leveraging LinkedIn as a medium for luring users into believing they are engaging with legitimate job offers.
Mrs. Umar elaborated on the malware’s dangerous capabilities, explaining, “CovertCatch can steal data, record keystrokes, and capture screen activity without being detected.” She added that the malware, once installed, can lead to devastating consequences, including financial losses, reputational damage, and severe data breaches for affected parties.
Risks to key industries
According to NITDA, CovertCatch is particularly concerning due to its ability to exploit vulnerabilities in essential sectors. Mrs. Umar pointed out that “the spread of CovertCatch malware via LinkedIn poses major risks to organizations and individuals.”
- Once embedded within a network or device, the malware can capture confidential information, setting the stage for potential follow-up attacks, such as ransomware.
- Furthermore, the malware’s presence within sensitive industry systems could compromise critical infrastructure and essential services, with implications for sectors that rely heavily on data security.
Mrs. Umar emphasized that CovertCatch increases “the risk of further attacks like ransomware and system-wide compromise,” which could have far-reaching effects on these industries.
Recommended security practices
NITDA’s advisory included a series of recommendations to help organizations and individuals avoid falling victim to the CovertCatch malware.
- Mrs. Umar urged LinkedIn users to be vigilant against unsolicited job offers or recruitment messages, especially those prompting file downloads or external links. “Organisations and individuals should be cautious of unsolicited job offers or recruitment messages on LinkedIn, particularly those that request file downloads or linking to external sources,” she advised.
- To mitigate potential risks, NITDA advised organizations to actively monitor any unusual login attempts and adopt security practices such as Multi-Factor Authentication (MFA) for all accounts. Mrs. Umar stressed the importance of regular security maintenance, recommending, “Keep antivirus software up-to-date and scan regularly to detect anomalies promptly.”
Additionally, the agency suggested that companies conduct periodic audits of LinkedIn connections and enforce role-based access restrictions on sensitive information. Mrs. Umar noted, “Organisations should periodically audit LinkedIn connections and restrict access to sensitive information based on role and necessity,” which she emphasized as a proactive measure to prevent unauthorized access.
