INTERPOL has arrested a suspect linked to a large-scale phishing and business email compromise operation in Nigeria after investigators uncovered around 2.1 million email addresses. The arrest formed part of INTERPOL’s Africa-wide cybercrime crackdown, Operation Serengeti III, which ran from June 29 to August 31, 2026. Across 21 countries, authorities carried out 1,462 arrests, disrupted 10,909 malicious networks, and recovered more than $105 million in illicit funds. Investigators found the Nigeria operation harvested software credentials and built its scale by collecting approximately 2.1 million email addresses. The scheme used phishing and business email compromise, where criminals exploit email systems and impersonate legitimate people or organisations to drive fraud. Authorities also recovered a luxury vehicle believed to have been bought with criminal proceeds. INTERPOL did not identify the suspect, name the organisations or individuals targeted, or provide precise losses tied to the Nigerian investigation. Operation Serengeti III involved agencies from multiple countries, supported by intelligence from 20 African countries and the United States before the operation began. Investigators received information on suspicious domains, internet protocol addresses, and command-and-control infrastructure connected to suspected criminal activity. Private-sector partners also supplied intelligence, technical analysis, and operational expertise. During the operation, INTERPOL said authorities identified 65,929 victims targeted by cybercriminal networks. Financial investigations linked criminal activity to losses exceeding $385 million. INTERPOL added that several other investigations under the same initiative remain active, with efforts continuing to identify additional suspects, trace illicit proceeds, and analyse seized digital evidence. In the latest Nigeria case, the suspect is arrested but INTERPOL has not publicly set out further legal details.