I4C Cautions Corporates And Finance Professionals Against ‘Boss Scam’: WhatsApp Account Takeover Through Malicious ‘Statement Of Account’, ‘MCA’ And ‘RBI’ Files Aimed At High-Value Financial Fraud

Key Highlights:

• Indian Cyber Crime Coordination Centre (I4C) cautions corporates and finance professionals against the ‘Boss Scam’.
• The scam involves WhatsApp account takeover through malicious files disguised as official communications from entities like RBI or MCA.
• Malicious files, often compressed (.zip) and containing Windows executables, install a Trojan to hijack WhatsApp Web sessions.
• The compromised accounts are then used for CEO impersonation fraud to instruct urgent fund transfers.
• I4C has protected over 10,000 Indians and alerted over 58,000 potential victims through SMS header ‘I4CMHA-G’.

Detailed Insights:

• Victims receive compressed files like "Statement of Account.zip" or "RBI.zip" via WhatsApp, SMS, or email, appearing as routine or urgent regulatory notices.
• Opening these files on a Windows device installs a Trojan, compromising the device and hijacking the victim’s active WhatsApp Web session.
• The compromised WhatsApp account is misused to circulate the malicious file to contacts, extending the chain of infection into corporate networks.
• The National Cybercrime Threat Analytics Unit (NCTAU) identified cross-border organized networks using advanced malware with DLL Sideloading methods.
• I4C shares threat signals with CERT-In, Microsoft Defender, and leading Indian anti-virus companies for rapid detection and blocking.
• Corporates are advised to sensitize employees, especially finance teams, and verify urgent fund-transfer instructions through direct voice calls.
• Citizens should not download unknown .zip files, regularly review WhatsApp linked devices, and report cyber frauds on National Cyber Crime Helpline number 1930.

Key Concepts Involved:

• I4C (Indian Cyber Crime Coordination Centre): An apex body under the Ministry of Home Affairs (MHA) to combat cybercrime in India.
• Boss Scam (CEO Impersonation Fraud): A type of cyber fraud where criminals impersonate senior executives to trick employees into making unauthorized financial transfers.
• Trojan: Malicious software disguised as legitimate software, designed to gain unauthorized access to a computer system.
• DLL Sideloading: A technique where a legitimate application loads a malicious Dynamic Link Library (DLL) instead of a legitimate one.