Home ›
Blog › Boss Scam Alert
📱 WHATSAPP FRAUD
'Boss Scam' Alert — WhatsApp Hijack Fraud Hits Delhi, Gujarat, Maharashtra & Rajasthan
📅 August 2026
⏱️ 6 min read
🛡️ CyberScamCheck.com Team
A fresh wave of "Boss Scam" cases has hit professionals across Delhi, Gujarat, Maharashtra and Rajasthan in the past week. Fraudsters are hijacking WhatsApp accounts through disguised ZIP files and then posing as company bosses to trick finance staff into transferring money to fraud accounts. India's Cybercrime Coordination Centre (I4C) has issued an active warning. Here's exactly how the scam works and how to stay safe.
⚠️
Key Rule: Never open a ZIP or compressed file sent via WhatsApp, SMS, or email from an unknown or unexpected source — even if it looks like a bank statement or official notice.
01 What Is the Boss Scam?
The Boss Scam is a new twist on executive impersonation fraud. Instead of directly messaging a victim and pretending to be their boss, criminals first take over the boss's actual WhatsApp account using malware. Once inside, they message the real employees and finance staff — from a familiar, trusted number — and instruct them to make "urgent" payments to accounts controlled by the scammers.
Because the message comes from a genuine, known contact, victims are far less suspicious than with a typical fake-number scam, which is what makes this version especially dangerous for businesses.
02 How the WhatsApp Hijack Works
🚩 The Attack Chain
- Victim receives a compressed file via WhatsApp, SMS or email, often named something like "Statement of Account.zip" or "RBI.zip"
- The file is disguised as an official bank statement or regulatory notice
- Opening it installs hidden malware on the device
- The malware hijacks the victim's active WhatsApp Web session
- Attackers now control the account and can message all saved contacts as if they were the real person
- They impersonate a senior executive and instruct finance staff to transfer funds urgently
Investigators note that the campaign is technically sophisticated, using evasion techniques designed to slip past standard antivirus detection — suggesting an organised, well-resourced operation rather than a lone scammer.
03 Warning Signs to Watch For
⚠️ Red Flags in the Message
- A ZIP or compressed attachment you weren't expecting, even from a known contact
- File names referencing "Statement," "RBI," "Invoice," or "Regulatory Notice"
- A request for an urgent fund transfer with no prior context or meeting
- Unusual writing style or tone from someone you know well
- Pressure to act immediately and avoid calling to confirm
🚫
Golden Rule: If a "boss" or colleague asks for an urgent payment over WhatsApp, always verify by phone call or in person before transferring any money — even if the chat looks completely normal.
04 What the I4C Advisory Says
The Indian Cybercrime Coordination Centre (I4C) first flagged this style of attack in an advisory issued in June 2026, warning citizens and companies about regulatory and executive impersonation linked to WhatsApp account takeovers. The agency has since shared technical details with security firms and antivirus companies to help detect and block the malware, and says thousands of potential victims have already been alerted and protected through a dedicated monitoring effort.
✅
Official Alerts: The Ministry of Home Affairs' cybercrime unit sends warning SMS messages from the header 'I4CMHA-G'. If you receive one, take it seriously and follow the safety guidance it provides.
05 If You've Already Opened the File
🚨 Immediate Steps
- Turn off your phone's internet connection (Wi-Fi and mobile data) immediately
- Log out of WhatsApp Web on all devices via Settings → Linked Devices
- Uninstall the file and run a trusted antivirus/anti-malware scan
- Change your WhatsApp PIN and enable two-step verification
- Warn your contacts, especially colleagues and finance staff, not to act on any recent messages from your account
- Report the incident at cybercrime.gov.in or call the National Cyber Crime Helpline 1930
06 How to Protect Yourself & Your Team
✅ Protection Checklist
- Never download or open ZIP/compressed files from WhatsApp, SMS or email unless you personally requested them
- Enable WhatsApp two-step verification (Settings → Account → Two-step verification)
- Regularly check Linked Devices in WhatsApp and remove any you don't recognize
- For businesses: require phone or in-person confirmation for any fund transfer request, no matter who it appears to come from
- Keep your phone's OS and antivirus software updated
- Educate finance and accounts teams specifically about this scam pattern
📊 Quick Reference — Boss Scam Signs
Unexpected ZIP Attachment
"Statement" or "RBI" File Names
Urgent Payment Request
Message From Known Contact
No Verification Call Allowed
Pressure to Act Immediately
🔍 Received a Suspicious Message or Link?
Paste any suspicious number, link, or message into our free AI checker for an instant scam risk analysis.
🛡️ Check for Free Now