LAGOS — Nigeria’s Federal High Court has been unwittingly serving as advertising space for an illegal Indonesian gambling operation. Any visitor who arrived at the court’s website through a Google search for gambling-related keywords was quietly redirected to a casino page carrying a SLOT88 copyright line. Visitors who typed the URL directly saw nothing wrong. The court had no idea.
That concealed redirect, discovered in May 2026 by Lagos-based security researcher Chris Nwobi, turned out to be one node in a sprawling campaign that has compromised approximately 20 government websites across 16 African countries, in some cases running undetected since November 2024. The court was not the most sensitive target. Also on the list: Nigeria’s Economic and Financial Crimes Commission, the National Emergency Management Agency, the National Broadcasting Commission, and a Yobe State public financial management portal. The agency that prosecutes online fraud in Nigeria had its website repurposed for it.
The operation is not a traditional cyberattack. Nothing was stolen and no systems were taken offline. What the syndicate wanted was borrowed credibility: the trust Google extends to official government domains. By embedding casino pages inside legitimate .gov infrastructure, the operators made their platforms appear more authoritative in search results, routing Indonesians looking for gambling sites through the websites of African courts, emergency agencies, and anti-corruption watchdogs.
Nwobi, founder of Zend Cybersecurity Threat Labs, described the technique as SEO cloaking. On some sites the gambling pages are hidden so completely that a standard browser session reveals nothing out of place. Nigeria’s Federal High Court loaded normally for any visitor who navigated directly to it. But traffic arriving from a gambling-related Google search was served a casino instead. “If you arrive from a Google search for gambling, it quietly serves you a casino instead,” Nwobi told investigators. The technical fingerprints pointed consistently toward Indonesia: GitHub accounts active during Indonesian business hours, payment pages built on QRIS, Indonesia’s national QR payment system, and customer support numbers traced to Indonesian operators.
The initial wave of compromises touched six countries: Nigeria, Egypt, Kenya, Uganda, Ghana, and South Africa. By June 2026, Nwobi had confirmed affected government infrastructure in ten more nations: Mozambique, Malawi, Mauritania, Rwanda, Niger, Burkina Faso, Ethiopia, Libya, Madagascar, and Tanzania. What connects nearly every compromised site is a technical commonality. Outdated WordPress plugins on government hosting environments that had received infrequent maintenance, in some cases for well over a year, gave the syndicate a straightforward entry point.
The scale of the exposure contrasts sharply with the pace of official response. Nigeria’s Minister of Communications, Innovation and Digital Economy, Bosun Tijani, reacted within three minutes of Nwobi’s initial disclosure, resulting in the prompt removal of three identified pages. That speed did not translate into a systematic audit of the remaining compromised infrastructure. In the weeks following the disclosure, the EFCC’s website remained on the list of affected sites. No cross-border coordination mechanism was publicly activated. African governments have not disclosed whether they have identified who uploaded the casino content or how long each site had been compromised.
There is an uncomfortable irony in where the syndicate chose to operate. Indonesia’s own government has designated illegal online gambling enforcement as a national priority. Communications and Digital Affairs Minister Meutya Hafid announced in July 2026 that Indonesian authorities had blocked more than 3.7 million websites linked to illegal gambling since October 2024, according to Xinhua. The crackdown also led to the closure of 32,500 bank accounts, the flagging of 85,500 mobile numbers, and the arrest of more than 1,160 individuals in 2026 alone, with assets seized valued at roughly $105 million. Yet an Indonesian-linked syndicate found it simpler to route traffic through the websites of African judicial bodies and anti-corruption agencies than to confront that enforcement at home.
Nwobi has outlined four remediation steps he considers essential: patching the compromised servers and removing the embedded casino content; deploying continuous automated monitoring so future intrusions surface in days rather than months; activating AfricaCERT, the continent’s cross-border cybersecurity coordination body, for real-time intelligence sharing among affected governments; and establishing baseline security standards for government hosting environments across the continent. None require advanced technology. They require maintenance schedules and institutional will.
The financial scope of the operation remains unknown. Payments routed through QRIS into nominee accounts obscure the money trail, and the syndicate’s apparent target audience was Indonesian gamblers navigating domestic restrictions, not African internet users. What African governments provided was not revenue; it was legitimacy by association. Whether any formal law enforcement investigation has been opened in Indonesia, Nigeria, or any of the 14 other affected countries has not been publicly confirmed.
The pattern tracks with what has become familiar in digital enforcement. As sweepstakes casino bans and other regulatory pressure on unregulated online gambling have tightened in markets with functioning enforcement, operators without legal standing have consistently shifted toward jurisdictions or technical mechanisms that are harder to police. The exploitation of African government domains through unpatched WordPress plugins represents the same dynamic: finding a gap in global digital infrastructure and occupying it quietly for as long as enforcement allows.
The Economic and Financial Crimes Commission, whose official website was among those identified as compromised, has not responded publicly to questions about when the breach was discovered or how long it persisted. The agency that prosecutes financial crime in Nigeria was, by investigators’ account, hosting an illegal casino for an unknown period of time. That question remains open.
