'Boss Scam' Alert: MHA Warns Against New Cyber Fraud Targeting CEOs and Executives for Illegal Financial Transfers; Check Details
The Ministry of Home Affairs has warned of a "Boss Scam" where cybercriminals impersonate regulators to target CEOs via malicious email or WhatsApp attachments. Once installed, the malware hijacks WhatsApp Web sessions, allowing attackers to trick finance staff into transferring funds to mule accounts.
The Indian Cyber Crime Coordination Centre (I4C), under the Ministry of Home Affairs (MHA), has issued an urgent advisory warning citizens and organisations about a rising cyber fraud known as the "Boss Scam" or CEO impersonation fraud. Cybercriminals are increasingly targeting high-ranking officials and chief executives to facilitate high-value financial transfers through sophisticated social engineering and malware.
Boss Scam Modus Operandi; Here's How the Scam Works
The fraud typically begins with cybercriminals contacting a senior executive via email or WhatsApp, impersonating officials from regulatory bodies such as the Reserve Bank of India (RBI). These messages create a false sense of urgency, claiming that the organisation has committed regulatory violations or requires immediate security upgrades. Kunal Shah Steps Down as CRED CEO to Lead WhatsApp Globally at Meta, Replacing Will Cathcart; Mark Zuckerberg Shares Welcome Message.
- Payload Delivery: The fraudulent messages contain a compressed .zip archive file that appears to be related to compliance or security. This archive contains malicious executable (.exe) and Dynamic Link Library (.dll) files.
- System Compromise: Once the executive downloads and executes the file on a Windows device, a Trojan dropper is initiated. This malware compromises the system and hijacks active WhatsApp Web session tokens, granting the attackers full access to the executive's genuine WhatsApp account.
- Financial Fraud: Armed with control of the account, fraudsters contact finance or accounts personnel, using the CEO's authority to instruct them to make immediate payments into attacker-controlled mule bank accounts.
- Contact Manipulation: In some instances, attackers modify the compromised device’s contact list, saving an attacker-controlled number under the name of the "CEO" to ensure future fraudulent instructions appear legitimate.
Cyber Fraud Protective Measures and Verification
The I4C has emphasised that finance departments are particularly vulnerable to these attacks because requests appear to originate directly from senior management. To mitigate this threat, the I4C has provided the following guidance:
- Independent Verification: Organisations must re-verify any urgent payment requests or account changes by using a direct voice call or in-person confirmation rather than relying solely on WhatsApp or email.
- Safe Handling of Files: Users should never install executable files received from unknown sources; regulators such as the RBI do not distribute software updates through WhatsApp attachments.
- System Security: Companies are urged to enforce software restriction policies, regularly review linked WhatsApp devices, and maintain updated malware-detection solutions on all Windows systems. Lucid Motors Layoffs: Company To Lay Off 18% of Workforce and Cut Production Shift Under New CEO Silvio Napoli.
Citizens and organisations are encouraged to report any suspected cyber fraud incidents immediately by calling the national cybercrime helpline at 1930 or by visiting the official National Cyber Crime Reporting Portal.
(The above story first appeared on LatestLY on Jun 22, 2026 08:18 PM IST. For more news and updates on politics, world, sports, entertainment and lifestyle, log on to our website latestly.com).
