NEW DELHI: The Union Ministry of Home Affairs (MHA) has issued a nationwide advisory warning corporate entities, Chartered Accountants, company directors, Chief Financial Officers (CFOs) and other finance professionals about a rapidly spreading cyber fraud known as the "Boss Scam", in which attackers compromise WhatsApp accounts to orchestrate high-value financial fraud.
The alert follows a sharp rise in complaints received through the National Cyber Crime Reporting Portal (NCRP), with incidents reported from several states, including Delhi, Gujarat, Maharashtra and Rajasthan.
According to the Indian Cyber Crime Coordination Centre (I4C) under the MHA, cybercriminals are using malicious files disguised as "Statement of Account", "RBI" or "MCA" documents to infect Windows computers and hijack victims' active WhatsApp Web sessions.
The malware is distributed through WhatsApp, SMS and email, often accompanied by messages posing as routine account statements or urgent regulatory notices requiring immediate compliance.
Technical analysis by the National Cybercrime Threat Analytics Unit (NCTAU), the cyber intelligence arm of the I4C, found that the campaign is being operated by organised cross-border cybercrime networks using advanced malware capable of evading detection through the DLL sideloading technique. Investigations are underway in coordination with law enforcement and technical agencies.
The MHA said the malware specifically targets Windows devices. Once a victim extracts and opens the malicious ZIP archive, a Trojan is installed that compromises the computer and takes control of the user's active WhatsApp Web session. In several cases, fraudsters have also impersonated the Income Tax Department through phishing emails.
After gaining access, the attackers use the compromised WhatsApp account to automatically circulate the same malicious files to the victim's contacts and groups, often asking recipients to forward the document to their company's finance manager for verification. This enables the malware to spread further within corporate networks.
In the final stage of the fraud, cybercriminals exploit the genuine WhatsApp account of a senior executive or manipulate contact details to impersonate a company's CEO.
They then send urgent instructions to finance and accounts personnel, directing them to transfer funds to mule bank accounts.
Given the nature of the attack, the MHA said finance departments face the highest risk. It urged organisations to sensitise employees, particularly those handling financial transactions, and to independently verify any urgent fund transfer request or account change instruction received via WhatsApp or email through a direct phone call or in-person confirmation before taking action.
The I4C has also issued a standard operating procedure (SOP) advising individuals and organisations not to download, extract or open ZIP files or executable programs received from unknown or unverified sources. It clarified that regulators such as the Reserve Bank of India (RBI) do not distribute software updates, security patches or account statements through WhatsApp attachments.
Users have been advised to regularly review WhatsApp's "Linked Devices" section and log out of inactive WhatsApp Web sessions. System administrators should block the execution of unknown executable (.exe) and Dynamic Link Library (.dll) files from user profile directories and ensure that all Windows systems are protected with up-to-date anti-malware software.
If an account is suspected to have been compromised, users should immediately log out of all linked devices, inform their contacts not to open any files received from the affected account, and scan the computer using updated antivirus software.
The advisory builds on an earlier warning issued by the I4C on June 22, 2026, titled "Regulatory and Executive Impersonation for WhatsApp Account Takeover Using Malicious Windows Executables and High-Value Financial Fraud."
To counter the threat, the I4C said it has begun proactively alerting identified victims and potential targets based on complaint analysis and technical intelligence. Threat indicators have also been shared with CERT-In, Microsoft Defender and Indian cybersecurity firms, including Quick Heal, K7 Computing and Net Protector, to facilitate rapid detection and blocking of the malware.
According to the ministry, these coordinated efforts have already protected more than 10,000 users, while over 58,000 potential victims have been alerted over the past month through SMS messages sent under the header "I4CMHA-G".
The ministry urged citizens to promptly act on such alerts and report suspected cyber fraud by calling the National Cyber Crime Helpline (1930) or through the National Cyber Crime Reporting Portal.
