NEW DELHI: The Union Ministry of Home Affairs (MHA) has issued a nationwide advisory warning corporate entities, Chartered Accountants, company directors, Chief Financial Officers (CFOs) and other finance professionals about a rapidly spreading cyber fraud known as the “Boss Scam”, in which attackers compromise WhatsApp accounts to orchestrate high-value financial fraud.
The alert follows a sharp rise in complaints received through the National Cyber Crime Reporting Portal (NCRP), with incidents reported from several states, including Delhi, Gujarat, Maharashtra and Rajasthan.
According to the Indian Cyber Crime Coordination Centre (I4C) under the MHA, cybercriminals are using malicious files disguised as “Statement of Account”, “RBI” or “MCA” documents to infect Windows computers and hijack victims’ active WhatsApp Web sessions.
The malware is distributed through WhatsApp, SMS and email, often accompanied by messages posing as routine account statements or urgent regulatory notices requiring immediate compliance.
Technical analysis by the National Cybercrime Threat Analytics Unit (NCTAU), the cyber intelligence arm of the I4C, found that the campaign is being operated by organised cross-border cybercrime networks using advanced malware capable of evading detection through the DLL sideloading technique. Investigations are underway in coordination with law enforcement and technical agencies.
The MHA said the malware specifically targets Windows devices. Once a victim extracts and opens the malicious ZIP archive, a Trojan is installed that compromises the computer and takes control of the user’s active WhatsApp Web session. In several cases, fraudsters have also impersonated the Income Tax Department through phishing emails.
After gaining access, the attackers use the compromised WhatsApp account to automatically circulate the same malicious files to the victim’s contacts and groups, often asking recipients to forward the document to their company’s finance manager for verification. This enables the malware to spread further within corporate networks.
In the final stage of the fraud, cybercriminals exploit the genuine WhatsApp account of a senior executive or manipulate contact details to impersonate a company’s CEO.
They then send urgent instructions to finance and accounts personnel, directing them to transfer funds to mule bank accounts.
Click Here For The Original Source.
