I4C Issues Warning Over Sophisticated Boss Scam Targeting Indian Executives

The Indian Cyber Crime Coordination Centre issued an urgent advisory warning organizations about the rapid rise of the “Boss Scam,” a sophisticated CEO impersonation fraud. Cybercriminals are targeting high-ranking corporate executives with malicious files to hijack communication channels and orchestrate unauthorized financial transfers.

New Delhi — The Indian Cyber Crime Coordination Centre, a specialized cybersecurity division operating under the Ministry of Home Affairs, flagged an escalating digital threat known as the “Boss Scam” or CEO impersonation fraud on Monday. Security officials urged corporations and senior management to implement heightened verification protocols against these highly targeted cyberattacks.

According to federal investigators, threat actors are systematically focusing on high-ranking executives and primary corporate decision-makers. The attackers distribute malicious payloads engineered to look like critical regulatory compliance notices, exploiting institutional trust to compromise internal systems.

The advisory published by the specialized cyber wing notes that these malicious archives are distributed through corporate emails or messaging applications like WhatsApp. By fabricating a false sense of administrative urgency and regulatory authority, the perpetrators trick executives into taking immediate action.

Once a recipient opens the corrupted archive, specific malware executes to compromise the targeted executive’s Windows operating system. The intrusion quickly escalates beyond basic device penetration, allowing attackers to systematically hijack active WhatsApp Web session tokens to control official communication channels.

With administrative access secured, digital fraudsters masquerade as the compromised executive to transmit highly convincing directives to lower-level staff or corporate finance departments. These deceptive messages instruct employees to authorize immediate financial transactions, resulting in fraudulent wire transfers.

Law enforcement officials pointed out that the strategic effectiveness of this fraud relies entirely on exploiting corporate hierarchy. Subordinate employees rarely question urgent financial directives that appear to originate directly from senior leadership, especially when sent via verified corporate communication accounts.

In response, the central cyber agency advised businesses to fortify their internal defensive protocols by enhancing worker awareness, establishing multi-layered verification for financial operations, and securing digital messaging infrastructure. Management must avoid downloading unverified attachments and audit active sessions on communication software.

Explaining the technical methodology utilized by these syndics, the federal advisory revealed that cybercriminals initiate contact with a CEO or director through electronic mail or WhatsApp. The hackers explicitly impersonate major financial regulators, most notably the Reserve Bank of India.

The initial message falsely alleges an ongoing regulatory non-compliance issue or mandates an immediate security infrastructure upgrade, forcing compliance within narrow timeframes. The digital communication contains a compressed ZIP archive containing a malicious executable file accompanied by a Dynamic Link Library component.

As documented in multiple active investigations, the targeted executive frequently forwards the deceptive message directly to their internal finance officer. When an employee extracts and runs the package on a Windows workstation, a specialized Trojan dropper initiates its deployment sequence.

The software establishes a persistent foothold within the enterprise network, compromises system files, and extracts active WhatsApp Web session tokens. Armed with direct access to the executive’s legitimate profile, the adversary commands finance teams to transfer corporate funds into designated mule accounts.

In secondary operational variants where attackers achieve total system takeover, they covertly manipulate the host device’s native contact directory. The fraudsters alter records to save an attacker-controlled telephone number under the identifier “CEO,” utilizing that secondary account to command staff to transfer operational capital.

To mitigate the threat of financial fraud, government authorities recommend that corporate accounting departments independently verify every urgent request for capital allocation or account modification. No transaction should ever be cleared based exclusively on a digital text or email.

The administrative advisory stressed that companies must implement a strict verification process using direct voice phone calls or face-to-face confirmation before processing funds. The National Cyber Crime Threat Analytics Unit emphasized that organizations must block unknown executable installations, clarifying that the central bank never distributes software updates via messaging apps.

Furthermore, network administrators must configure rigid Software Restriction Policies to completely block the execution of unrecognized executable files and library components originating from user profile directories. Enterprise IT units must actively audit connected hardware configurations.

Organizations are advised to inspect the linked devices menu within their primary mobile applications regularly and manually terminate any unmonitored browser sessions. Furthermore, corporate endpoints must be equipped with modern endpoint detection solutions capable of neutralizing persistent threats.

Finally, the federal cyber security agency instructed all corporate entities and targeted individuals to immediately report any identified fraudulent software applications or active cybercrime incidents to the national helpline at 1930 or via the official reporting portal at www.cybercrime.gov.in.

Future Outlook

As deepfake technology and automated malware generation tools become more accessible, the Ministry of Home Affairs anticipates that impersonation tactics will evolve beyond text-based communication. Security analysts predict that future variants of the Boss Scam will incorporate synthetic voice cloning to bypass the very voice-verification protocols currently recommended by the I4C. In response, Indian cybersecurity infrastructure is moving toward zero-trust architecture frameworks, where financial transactions will require multi-factor cryptographic approvals rather than relying on top-down hierarchical commands.

FAQs

What is the Boss Scam reported by the I4C?

The Boss Scam, or CEO impersonation fraud, is a digital attack where cybercriminals target senior corporate executives by sending malware disguised as regulatory documents. Once the executive’s system or WhatsApp Web session is compromised, the attackers message subordinate employees to demand urgent, fraudulent financial transfers.

How do attackers gain control of an executive’s WhatsApp account?

Attackers send a compressed ZIP file containing a malicious executable (.exe) and a Dynamic Link Library (.dll) file. When downloaded and executed on a Windows device, the malware establishes a persistent foothold and steals active WhatsApp Web session tokens, giving the fraudster full access to the account.

Does the Reserve Bank of India send official updates via WhatsApp?

No, the Reserve Bank of India and other official regulatory bodies never distribute mandatory software updates, security fixes, or compliance demands via WhatsApp attachments or unsolicited electronic communications.

What technical measures should system administrators take against this threat?

System administrators should enforce strict Software Restriction Policies (SRP) to block unverified executable and library files from running within user profile directories. They must also ensure endpoints run updated anti-malware software and regularly audit all linked devices in the WhatsApp application.

Where should corporate entities report an ongoing cyber fraud incident?

Victims of financial cyber fraud or corporate hacking should immediately report the incident to the national cybercrime helpline by dialing 1930 or by filing an official complaint online through the government portal at www.cybercrime.gov.in.