SEBI cautions firms against rising 'Boss Scam', Pg15

Key Highlights:

• The Securities and Exchange Board of India (SEBI) has issued a warning to regulated entities and listed companies regarding the escalating 'Boss Scam'.
• This cyber fraud involves criminals impersonating Chief Executive Officers (CEOs) or Managing Directors (MDs) to illicitly obtain funds.
• Fraudsters leverage advanced technologies such as Artificial Intelligence (AI), deepfake technology, and malicious software to deceive finance officials.
• The advisory was prompted by intelligence received from the Indian Cyber Crime Coordination Centre (I4C).

Boss Scam.jpg

Detailed Insights:

• The 'Boss Scam' is a form of social engineering attack, also known as Business Email Compromise (BEC) or executive impersonation fraud, designed to manipulate employees.
• One primary method involves using AI-generated voice cloning and manipulated video calls to convincingly imitate senior executives, pressuring employees for urgent fund transfers.
• The second method entails distributing malicious compressed (.zip) files containing executable (.exe) and Dynamic Link Library (.dll) files.
• These malicious files install malware that can hijack active WhatsApp Web sessions, enabling fraudsters to send fraudulent payment instructions from compromised accounts.
• SEBI has emphasized the need for organizations to strengthen internal verification procedures to prevent such frauds.
• The Indian Cyber Crime Coordination Centre (I4C), established by the Ministry of Home Affairs, serves as a national nodal agency to coordinate and combat cybercrime across India.
• India's primary legal framework for addressing cybercrime and electronic commerce is the Information Technology Act, 2000.

Scientific/Technical Concepts Involved:

• Boss Scam: A cyber fraud where criminals impersonate senior executives to trick employees into making unauthorized financial transfers or disclosing sensitive information.
• Deepfake Technology: Synthetic media created using AI and machine learning to manipulate or generate realistic but fabricated audio and visual content, often to deceive.
• AI-generated voice cloning: The process of creating a synthetic replica of a person's voice using AI and machine learning, often referred to as voice deepfakes.
• Malware: Malicious software designed to disrupt, damage, or gain unauthorized access to a computer system.
• Executable (.exe) file: A file format for Windows that contains instructions a computer can run directly.
• Dynamic Link Library (.dll) file: A file containing code and data that multiple programs can use, often exploited by malware for code execution or injection.