WhatsApp account hijacking: I4C warns of corporate fraud

The Indian Cyber Crime Coordination Centre (I4C) has warned companies and finance professionals about WhatsApp account hijacking used to order fraudulent corporate transfers, according to DD News. Attackers send malicious files disguised as account statements or regulatory notices, take control of an active WhatsApp Web session and use the compromised account to instruct finance staff to release money. ^[1]

DD News reported that the Ministry of Home Affairs had observed a sharp rise in related complaints on the National Cyber Crime Reporting Portal, with incidents reported from Delhi, Gujarat, Maharashtra and Rajasthan. The warning identifies chartered accountants, company directors, chief financial officers and accounts personnel as particularly exposed because the messages are tailored to financial operations. ^[1]

I4C issued an advisory on 22 June 2026 describing regulatory impersonation and malicious Windows files used for WhatsApp takeovers. The Securities and Exchange Board of India (SEBI) followed with a caution to regulated entities and listed companies on 17 July 2026, covering both account hijacking and other forms of executive impersonation. ^[2][3]

How a financial attachment becomes a payment instruction

According to DD News, victims receive compressed ZIP files through WhatsApp, SMS or email with names such as “Statement of Account.zip”, “RBI.zip” or “MCA.zip”. The messages resemble routine financial correspondence or urgent communications from the Reserve Bank of India (RBI) and the Ministry of Corporate Affairs (MCA). Some emails impersonate the Income Tax Department. ^[1]

I4C’s June advisory describes messages that falsely allege a regulatory violation or demand an urgent security improvement, with a short deadline for responding. Inside the compressed attachment is an executable programme, identified by the .exe extension, accompanied by a Dynamic Link Library, or .dll file. The agency describes cases in which a chief executive forwards the message to a finance officer. ^[2]

The critical step is extracting and running the file on a Windows desktop or laptop. I4C says this initiates a Trojan dropper, a malicious programme that installs malware, compromises the computer and hijacks the active WhatsApp Web session. The attack gives fraudsters access to the victim’s genuine messaging account. ^[2]

That access supports two parts of the campaign. According to DD News, the compromised account automatically circulates the malicious file to contacts and groups, sometimes asking recipients to forward it to their company’s finance manager and open it on a computer. I4C’s advisory separately describes fraudsters using the account to instruct accounts staff to make immediate payments to bank accounts used to receive the fraudulent transfers. ^[1][2]

The payment request may therefore come from an executive’s real WhatsApp account, rather than merely from an unfamiliar number carrying the executive’s name. I4C identifies this use of genuine account access as part of the “Boss Scam”, or chief executive impersonation fraud. ^[2]

Three routes to impersonating the boss

The official warnings describe related but distinct methods. I4C’s June advisory focuses on Windows malware and account takeover; SEBI’s July caution also covers digitally fabricated voices and video calls. ^[2][3]

The methods in the table are described in the I4C advisory and SEBI caution, rather than as stages that necessarily occur together in every attack. ^[2][3]

SEBI also identifies a pressure tactic accompanying some impersonation requests: finance officers may be told not to disclose the transaction because it involves Unpublished Price Sensitive Information. In that context, the purported confidentiality of market-sensitive information becomes part of the fraudster’s instruction to transfer money. ^[3]

The regulator’s malware account includes another possible victim within the organisation. It describes a finance officer opening the forwarded file, losing control of an active WhatsApp Web session and having that account used to contact other accounts or finance employees. The compromised account therefore need not belong to the chief executive. ^[3]

SEBI’s caution also extends beyond WhatsApp and email. It identifies Microsoft Teams and other social-media platforms among the channels through which people impersonating senior officials communicate instructions to subordinates or counterparts. ^[3]

What authorities have reported about the response

DD News reported that technical analysis by I4C’s National Cybercrime Threat Analytics Unit indicated organised cross-border networks were operating the campaign. The report attributed that assessment to the unit and said the matter was being investigated with law-enforcement and technical agencies. ^[1]

According to DD News, I4C shared malware indicators with the Indian Computer Emergency Response Team (CERT-In), Microsoft Defender, Quick Heal, K7 Computing and Net Protector to support detection and blocking. These indicators are technical details used to recognise the malicious files. ^[1]

The Home Ministry said coordinated interventions had protected more than 10,000 citizens, DD News reported. The report also said malware linked to the fraud was being blocked through the Sahyog Portal. ^[1]

I4C had alerted more than 58,000 potential victims through the SMS header “I4CMHA-G” during the preceding 30-day reporting period, according to DD News. The ministry’s figures describe protection and outreach, rather than a total of people who lost money. ^[1]

DD News also reported that I4C was identifying victims and potential targets through complaint analysis and technical intelligence, then alerting them so they could log out of linked devices and take remedial measures. ^[1]

Payment checks and Windows controls in the advisories

I4C’s recommendations address both the malicious file and the eventual payment instruction. Its June advisory calls for finance departments to verify urgent transaction requests or changes in account details through a direct voice call or in-person confirmation, rather than relying solely on WhatsApp text or email. ^[2]

SEBI’s July caution similarly tells regulated entities and listed companies not to transfer funds solely on instructions received through social-media platforms. It also advises verification before installing executable files, including confirmation by telephone when an attachment appears to come from a known sender. ^[3]

For system administrators, I4C recommends software restriction policies: controls that block unknown .exe and .dll files from running from user-profile folders. It also recommends updated malware protection on Windows computers and regular checks of WhatsApp’s Linked Devices list, with unused web sessions logged out. ^[2]

I4C states that regulators such as the RBI do not distribute mandatory software updates or security fixes through WhatsApp attachments. Both the I4C advisory and SEBI caution direct people to report scam incidents through the National Cyber Crime Helpline, 1930, or the National Cyber Crime Reporting Portal. ^[2][3]

References

^[1] DD News. Govt warns of WhatsApp ‘boss scam’ targeting corporates, finance …
ddnews.gov.in

^[2] Indian Cyber Crime Coordination Centre, National Cybercrime Threat Analytics Unit. Regulatory and Executive Impersonation for WhatsApp Account Takeover using Malicious Windows Executables and High value financial fraud. Advisory dated 22 June 2026.
i4c.mha.gov.in

^[3] Securities and Exchange Board India. Caution to Regulated entities and listed companies- Boss Scam. Press Release No. 40/2026, 17 July 2026.
sebi.gov.in