African Government Websites Exploited by Indonesian Gambling Syndicate

An investigation found that official government domains across 16 African countries were used to hide illegal gambling pages and boost their visibility in Google search results.

Government websites across 16 African countries were exploited by an Indonesian-linked gambling syndicate to promote illegal online casino and lottery pages, according to an investigation by Techpoint Africa.

The campaign reportedly affected around 20 government websites. Instead of defacing the sites or stealing public data, the attackers embedded hidden gambling pages inside trusted official domains, allowing the illegal pages to benefit from the search authority of government websites.

The first affected countries identified were Nigeria, Egypt, Kenya, Uganda, Ghana and South Africa. The investigation later expanded to Mozambique, Malawi, Mauritania, Rwanda, Niger, Burkina Faso, Ethiopia, Libya, Madagascar and Tanzania.

Cybersecurity researcher Chris Nwobi, founder of Zend Cybersecurity Threat Labs, said the operation was coordinated and financially motivated. The goal was not disruption, but visibility: government domains acted like high-trust advertising space for illegal gambling brands.

Techpoint reported that Nigerian sites linked to NILDS, NEMA and NAERLS were among the first discovered in May 2026. By June, the campaign had reached additional agencies, including the EFCC and government websites in Egypt, Ghana and Kenya.

Evidence cited in the investigation points to Indonesia. The gambling pages used Indonesian-language content, Indonesian support numbers and QRIS, Indonesia’s national QR payment system. Some code was also linked to GitHub activity aligned with Indonesian working hours.

In several cases, normal visitors saw legitimate government pages, while users arriving through gambling-related Google searches were redirected or shown casino content. A historical gambling subdomain was reportedly visible on Nigeria’s Federal High Court website as early as November 2024.

The campaign highlights a wider cybersecurity risk for African public institutions. Researchers said many affected sites relied on outdated software, unpatched plugins or exposed administration panels, making them vulnerable to low-cost exploitation.

For the gambling sector, the case shows how illegal operators can use cybersecurity weaknesses to bypass advertising restrictions and search-engine competition. Trusted public domains became infrastructure for offshore gambling promotion.

The issue also creates reputational risk for governments. Citizens may trust official domains, while search engines may rank them highly, giving illegal gambling pages a credibility advantage they could not achieve on their own.

The response requires more than page removal. Authorities need to patch compromised servers, audit government domains, monitor search results and coordinate across national CERTs. Because the same operation affected 16 countries, isolated takedowns are unlikely to be enough.

The case underlines a growing overlap between illegal gambling, search manipulation and public-sector cybersecurity. African governments are not the operators’ target market, but their domains have become tools in a cross-border gambling promotion network.