It Really Is Your CEO's WhatsApp Number. That Is the Problem.

Last week, the Indian Cyber Crime Coordination Centre issued a national advisory that should worry every founder who runs approvals over WhatsApp. Which, in India, is most of them.

The fraud is called the Boss Scam. The mechanics are not new — CEO impersonation fraud has existed for years. What changed is the delivery method. Earlier versions relied on spoofed numbers, cloned profile photos, and fake email domains. A sharp employee could usually catch the tell. This version does not need any of that, because the message genuinely comes from the CEO's real WhatsApp account, sent from the CEO's real phone number. There is no spoofing to detect, because nothing is being spoofed.

That is what makes this dangerous enough for the Home Ministry to put out a country-wide warning.

What the I4C Advisory Actually Says

The advisory came from the National Cybercrime Threat Analytics Unit, operating under the Indian Cyber Crime Coordination Centre, in late June 2026. It describes a pattern investigators have now seen across multiple confirmed cases targeting CEOs, promoters, and senior executives at Indian companies.

The attack starts with impersonation. Fraudsters pose as a regulator — the Reserve Bank of India, a government compliance body, sometimes a cybersecurity authority — and send an urgent message to a senior executive, usually over email or WhatsApp. The message claims something needs immediate attention. A compliance update. A security patch. An audit document that requires review.

Attached is a compressed ZIP file. Open it, and inside sits an executable file paired with a DLL — sometimes other formats too, scripts ending in .vbs, .bat, or .js have shown up in reported cases. To the person opening it, none of this looks unusual. It looks like a document they were told to expect.

The moment that file runs on a Windows machine, the damage is already done.

How the Attack Actually Works

The malware installs silently and stays. This is not smash-and-grab malware. I4C describes it functioning as a Trojan dropper — it installs quietly, establishes persistent access to the device, and does not announce itself. The executive has no reason to suspect anything happened. Their laptop behaves normally.

It hijacks the active WhatsApp Web session. This is the part that makes this scam different from everything before it. The malware steals the session tokens tied to an active WhatsApp Web login. With those tokens, an attacker controls the executive's actual WhatsApp account — not a fake one, not a cloned one — without ever touching the phone and without ever knowing the password.

Fraudulent messages go out from the real account. Once the session is hijacked, the attacker starts messaging the executive's own contacts — typically finance, accounts, or payroll staff — instructing urgent fund transfers to specified bank accounts. Investigators noted a recurring detail in multiple cases: the CEO's account is used to directly forward the instruction to the finance officer. From the receiving end, this is indistinguishable from a real message, because it is one.

The most advanced cases go further. In some incidents, attackers achieve full device takeover and quietly edit the phone's contact list. They save a new, attacker-controlled number under the CEO's name. Even if someone later notices the original WhatsApp Web session and logs it out, the fraud can continue from this second number — and it still shows up on screen with the CEO's name attached. Most people trust the name they see, not the digits behind it.

Why This Breaks the Old Defense

The standard advice for CEO fraud has always been: check the number. Look for spelling mistakes in the display name. Watch for a slightly different profile photo.

None of that works here. The number is real. The name is real. The account is real. The advisory itself notes that this version is structurally harder to catch than conventional phishing, precisely because it removes the one signal employees have been trained to look for.

What is left to catch is behavior, not identity. A request that is unusually urgent. An instruction that skips the normal approval chain. A transfer to an account nobody recognizes. These are the only tells that survive once the sender's identity itself can no longer be trusted.

Why This Lands Especially Hard on Indian SMEs

WhatsApp is not a side channel for most Indian businesses. It is the channel. Approvals happen there. Vendor coordination happens there. In a lot of smaller companies, the founder or MD makes the call and the team executes — quickly, with minimal friction, because that speed is part of what makes a small company fast.

That same speed is exactly what this scam is built to exploit. A flat hierarchy where one person's word moves money fast is efficient on a normal day and catastrophic on the day that person's account is compromised. The fewer checkpoints a payment instruction has to pass through, the less time there is for someone to notice something is wrong.

This is not a reason to slow your company down permanently. It is a reason to put exactly one checkpoint in front of money movement that does not depend on trusting a name on a screen.

The Detection Window Nobody Is Talking About

Here is the part that gets lost in most coverage of this scam. The malware does not appear and immediately commit fraud. It sits. It establishes a foothold. It communicates with attacker-controlled infrastructure in the background while everything on the surface looks completely normal.

That gap — between infection and the moment fraud actually happens — is the only window where this is stoppable before money moves. A device quietly phoning out to an unfamiliar server. A background process that was not there last week. A spike in outbound connections from one laptop at 1 AM. None of these require knowing the malware's exact signature. They require watching for behavior that does not belong.

This is the same principle behind early-warning detection generally. You are not trying to recognize every possible attack in advance. You are trying to notice when something on your network is doing something a normal device or account never does — and catching it in that quiet window before it turns into a wire transfer that cannot be reversed.

What to Actually Do About This

Treat unexpected ZIP files as hostile by default. No regulator sends security patches or compliance fixes as a WhatsApp or email attachment. I4C says this explicitly. If a ZIP file shows up claiming to be from RBI, a ministry, or any authority, that claim alone is the red flag.

Put one verification step between any message and any money. Out-of-band confirmation, every time, regardless of who the request appears to come from. A phone call to a number you already had saved — not one you were just given. This single habit defeats the entire scam, because the malware can fake the message but it cannot fake a live phone call where the real person says something different.

Review your WhatsApp linked devices regularly. Every WhatsApp account shows which devices are logged into Web or Desktop sessions. Check this periodically. Log out anything you do not recognize immediately.

Restrict what executables can run on company machines. Software restriction policies that block unauthorized executables are a basic control that stops this entire attack chain at the point of infection, before the WhatsApp session is ever touched.

Watch for the infection, not just the message. By the time a fraudulent payment instruction arrives, the malware has usually been sitting on the device for a while. Monitoring for unusual outbound activity, new persistent processes, and abnormal behavior on executive devices catches the attack at the point where it is still reversible.

Frequently Asked Questions — Boss Scam and WhatsApp CEO Fraud

What is the Boss Scam? The Boss Scam is a CEO impersonation fraud where attackers use malware delivered through a fake regulatory message to hijack an executive's actual WhatsApp Web session. They then send fraudulent payment instructions directly from the executive's genuine account to finance or payroll staff.

How is this different from regular CEO fraud or phishing? Traditional CEO fraud relies on a spoofed number, a cloned profile, or a lookalike email domain — all of which leave detectable inconsistencies. The Boss Scam uses the executive's real, authentic WhatsApp account, removing the identity-based red flags that employees are usually trained to spot.

Can attackers really take over WhatsApp without knowing the password? Yes. The malware steals active WhatsApp Web session tokens rather than login credentials. This gives attackers control of the account through an already-authenticated session, without needing a password or physical access to the phone.

How do I know if my WhatsApp Web has been compromised? Check your linked devices list inside WhatsApp settings regularly. Any device or session you do not recognize should be logged out immediately. Unusual messages sent from your account that you did not write are another clear sign.

What should finance teams do when they receive an urgent payment request, even from the CEO? Verify it through a separate channel before acting — a direct phone call to a number already on file, not one provided in the message. Urgency itself should be treated as a reason to verify more carefully, not less.

Does the DPDP Act apply if Boss Scam malware leads to a data or financial breach? If the malware results in unauthorized access to personal data alongside the financial fraud, DPDP Act obligations around security safeguards and breach notification apply. Failing to have basic controls against known, government-flagged threats like this one weakens an organization's position significantly if regulators examine the incident afterward.

---

CyberSharcX is an early-warning cyber threat detection platform for Indian startups and SMEs. We watch for the quiet behavior that precedes fraud — the unfamiliar process, the unusual outbound connection — so you catch it before a transfer goes out, not after. Learn more at cybersharcx.in