At least 16 African governments have had their official websites quietly hijacked — not by hackers stealing data, but by an Indonesian gambling syndicate slipping illegal casino and lottery pages into the same domains citizens trust for public services.
The investigation, first published by TechPoint Africa on July 23, 2026, reveals that the syndicate exploited roughly 20 government websites across Africa to boost its online casino brands in Google search results. The motive is simple: Google trusts a .gov domain, and that trust translates directly into higher search rankings for illegal gambling content.
How the Attack Works
The syndicate does not take websites down or steal citizens' data — at least not visibly. Instead, it quietly embeds its own casino pages inside government web infrastructure, borrowing the official domain's credibility the way a billboard advertiser borrows the reach of a major highway.
That analogy comes directly from Chris Nwobi, an independent security researcher and founder of Zend Cybersecurity Threat Labs, who first discovered the syndicate's activities.
"On some sites, they hide it even better. Nigeria's Federal High Court website looks completely normal to a regular visitor, but if you arrive from a Google search for gambling, it quietly serves you a casino instead." — Chris Nwobi, Zend Cybersecurity Threat Labs
That kind of conditional delivery — showing clean government content to direct visitors while redirecting search traffic to gambling pages — makes detection especially difficult for government IT teams doing routine checks.
The Timeline: From Three Nigerian Sites to a Continent-Wide Operation
Nwobi says he first spotted the breach in May 2026, when three Nigerian federal websites turned up serving Indonesian gambling content. Those sites were NILDS (National Institute for Legislative and Democratic Studies), NEMA (National Emergency Management Agency), and NAERLS (National Agricultural Extension and Research Liaison Services). One of them carried a "SLOT88" copyright line in the embedded pages.
By June 2026, the operation had expanded to include Nigeria's EFCC (Economic and Financial Crimes Commission) website, along with sites in Egypt, Ghana, and Kenya. The initial six-country footprint — which also included Uganda and South Africa — has since grown to cover ten additional countries: Mozambique, Malawi, Mauritania, Rwanda, Niger, Burkina Faso, Ethiopia, Libya, Madagascar, and Tanzania.
Among the Nigerian websites now confirmed affected are the Federal High Court, the National Broadcasting Commission (NBC), the Nigeria Extractive Industries Transparency Initiative (NEITI), the Lagos State Public Procurement Agency, and Yobe State's public financial management portal. Historical records show a gambling subdomain on the Federal High Court's website dating back to as early as November 2024 — meaning parts of this operation may have been live for well over a year before anyone noticed.
All Signs Point to Indonesia
The attribution trail is unusually clear. Code linked to the operation was published on GitHub accounts operating on Indonesian time. Payment pages embedded in the gambling content used Indonesia's national QR payment system. Support numbers traced back to Indonesian contacts. No cryptocurrency is involved — this is straightforward illegal online gambling, structured and coordinated.
Nwobi describes it as a coordinated operation run by an organised group, not a lone actor. The sophistication — spanning multiple countries, government domains, and a year-long undetected run — reflects the kind of online security threat that African public institutions are demonstrably underprepared to counter.
The Bigger Danger
Right now, the syndicate's apparent goal is search engine manipulation for gambling revenue. But the access they have demonstrated is the real alarm. Any group that can silently insert and serve custom pages through a government's web infrastructure has, by definition, a foothold that could be used for far more damaging ends — data harvesting, phishing pages targeting citizens, or planting malware.
The 16-country spread also signals that this was not opportunistic. These were not random vulnerabilities stumbled upon — the systematic targeting of .gov domains across English, French, and Arabic-speaking African nations suggests deliberate reconnaissance and a scalable attack method.
For governments still running legacy web infrastructure with limited cybersecurity staffing, the uncomfortable reality is that the syndicate likely is not the only group that is found the door open.