WhatsApp ‘Boss Scam’ explained: Received a fake RBI or MCA file? Here’s how scammers can target you

The Indian Cyber Crime Coordination Centre (I4C) has warned professionals and businesses about a growing WhatsApp scam in which cybercriminals use fake regulatory documents to take control of accounts and eventually trick company employees into transferring money.

The campaign has been reported from Delhi, Gujarat, Maharashtra and Rajasthan, with Chartered Accountants, company directors, Chief Financial Officers (CFOs) and finance and accounts teams among those considered particularly vulnerable.

The “Boss Scam”, also known as CEO impersonation fraud, is a cyber fraud in which criminals pretend to be a company’s senior executive and use that identity to pressure employees into making unauthorised financial transfers.

What makes the latest version more dangerous is that scammers may not simply create a fake WhatsApp number and pretend to be the CEO. They can first compromise a senior executive’s computer and hijack an active WhatsApp Web session.

This means a finance employee could receive an urgent payment request from what appears to be the genuine WhatsApp account of the CEO or another senior executive.

Don't Miss: Indian Railways latest travel update: 2 new trains, 4 routes extended, 7 new stoppages — check if your route is covered

The fraud relies on authority and urgency. Employees may be told that a payment needs to be made immediately, with the criminals directing the money to accounts controlled by them or their associates.

How does the attack begin?

The operation typically starts with a message sent to a senior executive through WhatsApp, SMS or email.

The message may appear to come from a regulator and refer to an urgent compliance requirement. The attached file could be named “Statement of Account.zip”, “RBI.zip” or “MCA.zip”. Some files reportedly carry a date before the name.

Emails impersonating the Income Tax Department have also been reported.

The objective is to make the recipient believe that the attachment is an important financial or regulatory document that needs to be opened quickly.

What happens when the file is opened?

The ZIP archive contains a malicious Windows executable file (.exe) along with a Dynamic Link Library (.dll) file.

When the files are extracted and executed on a Windows computer, malware is installed. I4C’s technical analysis found that the campaign uses DLL sideloading, a technique that can help malicious software evade detection.

The malware can compromise the computer and hijack an active WhatsApp Web session. Once attackers gain access, they can use the victim’s account to contact other people and spread the malicious file further.

What makes this different from an ordinary fake-CEO scam?

In a conventional CEO impersonation scam, criminals usually create a fake account, spoof an identity or send messages from an unrelated number.

The newer method can go a step further by taking control of the executive’s actual WhatsApp Web session.

That removes one of the easiest warning signs for employees: checking whether the message came from the CEO’s usual number.

The attack therefore combines technical compromise with social engineering. The malware gets the attackers into the communication channel, while the fake payment instruction exploits the employee’s trust in senior management.

Must Read: Trump Towers is coming to Hyderabad—65-storey, 800-foot towers set to become South India’s tallest

I4C has protected more than 10,000 Indians

I4C said coordinated action has so far protected more than 10,000 Indians from the campaign.

Threat signals and technical indicators linked to the malware have been shared with CERT-In, Microsoft Defender and Indian antivirus companies including Quick Heal, K7 Computing and Net Protector.

The malicious files are also being blocked through the government’s Sahyog Portal.

I4C has separately alerted more than 58,000 potential victims in the last 30 days through the SMS header “I4CMHA-G”.

People receiving alerts from this header have been advised to follow the security instructions promptly.

What should companies and employees do?

I4C has advised companies to independently verify every urgent payment instruction received through WhatsApp or email.

For a large or unusual transfer, employees should confirm the request through a direct voice call or in-person communication rather than relying only on a message.

Companies should also:

• Avoid opening ZIP files or executable files received from unknown or unverified sources.
• Never assume that a file is genuine simply because it appears to come from a known contact.
• Regularly check WhatsApp > Settings > Linked Devices and remove sessions that are no longer in use.
• Keep Windows systems and antivirus software updated.
• Restrict the execution of unknown .exe and .dll files from user profile directories.
• If an account is compromised, immediately log out of all linked devices and warn contacts not to open files sent from the account.
• Scan the affected computer using updated security software.

The I4C advisory also stresses that regulators such as the RBI do not send software updates, security fixes or account statements through WhatsApp attachments.

What to do if you have been targeted

Anyone who receives a suspicious file or believes their account or computer has been compromised should act immediately.

Cyber fraud can be reported through the National Cyber Crime Helpline at 1930 or the National Cyber Crime Reporting Portal.

I4C had first warned about this specific form of regulatory impersonation and WhatsApp account takeover in its June 22, 2026 advisory. The latest cases have been reported across multiple states, prompting a fresh warning for corporate and finance teams.