Amid rising cyber fraud in the country, the Indian Cyber Crime Coordination Centre (I4C) has issued a warning regarding a new and highly dangerous ‘Boss Scam.’ In this scam, hackers gain control over individuals’ computers and WhatsApp accounts by sending fake ZIP files via WhatsApp, email, or SMS. Subsequently, these compromised accounts are used to defraud company employees of sums running into crores of rupees. Let us understand what the ‘Boss Scam’ is and how you can protect yourself from it.
How the ‘Boss Scam’ Works
According to the I4C, which operates under the Ministry of Home Affairs (MHA), cybercriminals send files with names like “Statement of Account.zip,” “RBI.zip,” or “MCA.zip” via WhatsApp, email, or SMS. These files are crafted to appear like bank statements or important notifications from government departments.
The files are often accompanied by messages that create a sense of urgency, pressuring the recipient to take immediate action. As soon as a person downloads the ZIP file and opens it on a Windows computer, the malware contained within it installs itself on the system.
WhatsApp Accounts Can Be Hacked
According to the I4C, the ZIP file contains a dangerous Windows Executable (.exe) and a DLL file. Upon opening, a Trojan malware installs itself on the computer and hijacks the active WhatsApp Web session. Cybercriminals then use the victim’s WhatsApp account to send the same infected file to all their contacts and groups. In many instances, the accompanying message instructs the recipient to forward the file to the company’s finance manager for verification.
Targeting Finance Teams
According to the I4C, this cyber campaign specifically targets Chartered Accountants, company directors, CFOs, finance managers, and accounts departments. Since the file names are often linked to account statements, the RBI, the MCA, or the Income Tax Department, finance department employees can easily fall prey to these scams.
This leads to fraud worth crores…
When a senior official’s WhatsApp account is hacked, cybercriminals use that account to instruct the finance team to transfer funds immediately. In some instances, cybercriminals save their own number as “CEO” on the victim’s mobile phone. They then message the accounts department, directing them to transfer money to a specific bank account right away. Because the message appears to come from the CEO, many employees process the payment without verifying it first.
I4C issues important advisory
The Ministry of Home Affairs has issued several key recommendations for individuals and companies. Do not download or open ZIP files received via unknown WhatsApp messages, SMS, or emails. Government bodies like the RBI, MCA, or the Income Tax Department do not send updates via ZIP files on WhatsApp. Periodically check your linked devices by going to WhatsApp Settings > Linked Devices and immediately log out of any unrecognized devices. Always use updated antivirus software or Microsoft Defender on Windows computers.
If you receive instructions regarding urgent payments or changes to bank account details, always verify them first through a phone call or a face-to-face conversation. If your WhatsApp account is hacked, immediately log out from all linked devices and alert all your contacts.
Major steps taken by I4C
I4C stated that action is being taken against this campaign in collaboration with multiple agencies. Information regarding the malware has been shared with CERT-In, Microsoft Defender, Quick Heal, K7 Computing, and Net Protector. Additionally, malicious files are being continuously blocked through the ‘Sahyog’ portal.
Where to report cyber fraud?
If you receive any such suspicious file, WhatsApp message, or email, or if you fall victim to cyber fraud, immediately call the National Cyber Crime Helpline at 1930 or file a complaint at www.cybercrime.gov.in.
