I4C warns CFOs, finance teams of WhatsApp ‘Boss Scam’ using fake RBI, MCA files

The Indian Cybercrime Coordination Centre (I4C) has warned companies and finance professionals about a growing cyber fraud campaign in which malicious files disguised as account statements and regulatory communications are being used to hijack WhatsApp accounts and facilitate high-value financial fraud.

The Ministry of Home Affairs agency said it has observed a sharp rise in complaints on the National Cyber Crime Reporting Portal (NCRP) involving the takeover of WhatsApp accounts belonging to professionals and businesspersons. Similar incidents have been reported from several states, including Delhi, Gujarat, Maharashtra and Rajasthan.

Separately, according to a Moneycontrol report, I4C’s Threat Analytics Unit identified Horizon Cash Service, Money Score Monitor and Zelicredit as malicious loan applications targeting Android users seeking quick loans. The apps allegedly posed as legitimate lenders, promising quick approvals and low interest rates, but charged borrowers exorbitant interest after disbursing loans.

The three apps were also allegedly found to access extensive data stored on users’ mobile devices after installation, raising concerns over the misuse of sensitive information. The development is separate from I4C’s warning on the WhatsApp-based “Boss Scam”.

MUST READ: RBI proposes new loan pricing rules: Banks, NBFCs may face tighter interest rate norms

Malicious files disguised as RBI, MCA documents

According to I4C, victims of the WhatsApp campaign typically receive compressed ZIP files through WhatsApp, SMS or email with names such as “Statement of Account.zip”, “RBI.zip” or “MCA.zip”. Some account statement files may carry a date prefix, such as “0714 Statement of Account.zip”.

The messages are designed to look like routine financial communications or urgent notices from regulators, including the Reserve Bank of India (RBI) and Ministry of Corporate Affairs (MCA), and may demand action within a short deadline. I4C said some emails have also been found impersonating the Income Tax Department.

The ZIP archive contains a malicious Windows executable (.exe) along with a Dynamic Link Library (.dll) file. When extracted and opened on a Windows computer, the malware installs a Trojan that can compromise the device and hijack the victim’s active WhatsApp Web session.

ALSO READ: Home Loan: Applying with a co-applicant? Their credit score could affect your loan availability

Compromised accounts used for fund transfers

Once an account is compromised, the malware can automatically send the same malicious file to the victim’s contacts and WhatsApp groups. Recipients are often asked to forward the file to their company’s finance manager for verification and open it on a computer, allowing the malware to spread further through corporate networks.

The attack can then escalate into what I4C describes as the “Boss Scam” or CEO impersonation fraud. Fraudsters may use a genuine WhatsApp account belonging to a senior executive, or save an attacker-controlled number under the name of the CEO, to send urgent instructions to accounts and finance employees to transfer funds to mule bank accounts.

I4C’s National Cybercrime Threat Analytics Unit said its technical analysis indicates that organised networks operating across national borders are behind the campaign. The malware uses advanced propagation and detection-evasion techniques, including DLL sideloading.

Over 58,000 potential victims alerted

I4C said it has shared threat signals and technical indicators with CERT-In, Microsoft Defender and Indian cybersecurity companies Quick Heal, K7 Computing and Net Protector to support detection and blocking of the malicious files.

More than 10,000 Indians have so far been protected through coordinated interventions, with malware being blocked through the Sahyog Portal. I4C has also intimated more than 58,000 potential victims in the past 30 days through the SMS header “I4CMHA-G”.

The agency has urged companies to sensitise employees, particularly finance teams, and independently verify urgent fund-transfer or account-change requests through a direct voice call or in-person confirmation.

I4C has advised users not to download, extract or open ZIP files or executables from unknown or unverified sources. It also recommended regularly reviewing WhatsApp’s linked devices and logging out of inactive sessions.

In case of compromise, users should immediately log out of all linked devices, alert contacts not to open files received from the account and scan the computer with updated antivirus software. Suspicious cyber fraud should be reported through 1930 or cybercrime.gov.in.

MUST READ: Can banks change your loan benchmark? RBI draft says borrower consent will be needed