Police in 21 countries have arrested 1,462 cybercrime suspects in Operation Serengeti III. It’s the third round of an Africa-wide crackdown coordinated by INTERPOL, the international police organisation based in Lyon, France, and it ran from 29th June to 31st August 2026. INTERPOL announced the results on 22nd October 2026.
Investigators recovered more than USD 105 million, or about KES 13.6 billion. They also took down 10,909 malicious networks, which are the websites, servers and other online infrastructure criminals use to run scams and attacks. Investigators identified 65,929 victims targeted by cybercriminal networks, and linked more than USD 385 million in losses, about KES 50 billion, to their activity. So the money recovered is roughly a quarter of what was lost.
Kenya took part, alongside 19 other African countries and the United States. If you’re in Kenya, you’re probably wondering whether any of those arrests happened here, and whether any of that money came back to people here. INTERPOL hasn’t broken its numbers down by country, so for now there’s no way to tell.
How the operation works
INTERPOL doesn’t arrest anyone itself. It collects intelligence and hands it to national police, who make the arrests under their own laws. Before Serengeti III started, investigators in the 21 countries were given lists of suspicious domains, IP addresses and command-and-control servers, the machines criminals use to send instructions to hacked computers. Ten partners helped put that intelligence together, from security companies such as Group-IB, Kaspersky and Fortinet to Meta, the Global Anti-Scam Alliance and Zimbabwe’s telecoms regulator. Police then had two months to act on it.
The operation went after online scams, ransomware (malware that locks a company’s files until a ransom is paid), digital extortion and business email compromise, where a fraudster poses as a boss or supplier over email to get staff to pay into the wrong account.
Call centres in Uganda and crypto mines in Angola
Uganda had the most arrests of any case INTERPOL singled out. Authorities there broke up two fraud rings and arrested 365 foreign nationals, which is a quarter of all the arrests in the operation. The rings ran rotating call centres with scripts, fake trading platforms and fraudulent websites. Their targets were pensioners in Asia, who were talked into investing in things that didn’t exist.
In Angola, investigators shut two illegal cryptocurrency mining centres and arrested nine people. They seized more than 2,000 mining machines and six illegal power transformer stations, and the electrical equipment alone was worth more than USD 1 million, about KES 130 million. Crypto mining uses a lot of electricity, which would explain the transformer stations. It’s not Angola’s first time either. In Serengeti 2.0 last year, its authorities shut 25 mining centres and seized equipment worth more than USD 37 million, about KES 4.8 billion.
Nigeria had two cases. In the first, one suspect ran a phishing and business email compromise operation that stole software logins and collected about 2.1 million email addresses. Police also recovered a luxury car they suspect was bought with the proceeds. In the second, a suspect promoted a fake investment scheme over messaging apps, and investigators traced more than USD 2.4 million in suspected criminal proceeds, about KES 312 million, much of it laundered through crypto.
Elsewhere, authorities in Tanzania dismantled what INTERPOL calls a malicious mobile loan app scheme. Gabon disrupted a vehicle import scam run on social media, and the Republic of Congo arrested 30 people in a cybercrime case.
Kenya’s part
Kenya has been in all three Serengeti operations. In the first, in late 2024, Kenyan officers cracked an online credit card fraud linked to losses of USD 8.6 million, about KES 1.1 billion, and made nearly two dozen arrests. We covered that case when INTERPOL announced it. Earlier this year, Kenyan police made 27 arrests over fake global investment schemes in Operation Red Card 2.0, a separate INTERPOL sweep we reported on in February.
This time, INTERPOL lists Kenya as a participant and that’s it. Its results give no arrest count, recovery figure or victim number for any single country. So we can’t say how many of the 1,462 suspects were picked up in Kenya, or how much of the USD 105 million was Kenyan money. INTERPOL also doesn’t say how recovered money gets back to victims, which nationalities the 365 people arrested in Uganda are, or anything more about the Tanzania, Gabon and Congo cases.
Three years of Serengeti
| USD 1 = KES 129.87 | Serengeti (2024) | Serengeti 2.0 (2025) | Serengeti III (2026) |
|---|---|---|---|
| Dates | 2nd September to 31st October 2024 | June to August 2025 | 29th June to 31st August 2026 |
| Countries | 19 African | 18 African plus the UK | 20 African plus the US |
| Arrests | 1,006 | 1,209 | 1,462 |
| Victims identified | More than 35,000 | Nearly 88,000 | 65,929 |
| Networks or infrastructure taken down | 134,089 | 11,432 | 10,909 |
| Money recovered | Not given | USD 97.4 million (about KES 12.6 billion) | More than USD 105 million (about KES 13.6 billion) |
Sources: INTERPOL’s releases for 2024, 2025 and 2026.
Arrests have gone up every year, and Serengeti III has the most of the three. The other rows don’t line up as neatly. Fewer victims were identified than last year. The 2024 count of 134,089 is also more than ten times the later ones, but INTERPOL called them “malicious infrastructures and networks” that year, so the rounds probably didn’t count the same things. And an arrest isn’t a conviction. INTERPOL says several investigations are still open, with police still looking for more suspects and tracing money.
What it means for Kenya
The losses these operations go after are growing. In August, INTERPOL’s African Cyberthreat Assessment Report 2026 put cybercrime-related losses in Africa at USD 484 million, about KES 62.9 billion, up from USD 192 million, about KES 24.9 billion, since 2024. It found AI enabling 55% of reported cybercrimes and named East Africa as a hub for mobile money fraud. At the time, we looked at its Kenyan numbers, including SIM swap fraud.
Against that, recovering roughly a quarter of the losses in a single operation is a real result. What Serengeti III mostly shows, though, is that the schemes Kenyans already know (fake investment platforms, dodgy loan apps and email fraud) are running across the continent. For us, the number that matters is the Kenyan one. Until the Directorate of Criminal Investigations (DCI), the Kenyan police’s investigations arm, or INTERPOL publishes it, we don’t know what this sweep did here.
Join the discussion