A rapidly evolving WhatsApp “Boss Scam” is targeting CFOs, chartered accountants, company directors and finance teams by exploiting trust in familiar contacts and senior executives.
Attackers distribute malicious files disguised as “Statement of Account,” “MCA,” “RBI” or other financial communications through WhatsApp, SMS and email.
Opening them can compromise devices and hijack WhatsApp accounts.
The malware has evolved across VBS, ZIP, IMG and VHD files, using techniques such as DLL sideloading and Bring Your Own Vulnerable Driver (BYOVD) to weaken endpoint security and establish persistent remote access.
Compromised executive WhatsApp accounts can then be misused to instruct finance employees to transfer money to mule accounts.
Infected WhatsApp Web sessions may also automatically spread malicious files across trusted business networks.
The Indian Cyber Crime Coordination Centre (I4C) says it has alerted over 58,000 potential victims in 30 days, while geo-blocking malicious servers has protected more than 10,000 Indians.
The message is simple: verify before you trust—even when instructions come from the boss.
