4 states hit as WhatsApp 'Boss Scam' hijacks accounts via .zip files

For cybersecurity professionals, the 'Boss Scam' represents a classic social-engineering attack supercharged by WhatsApp's trusted contact model. The use of compressed files with names like 'RBI.zip' and an auto-forwarding mechanism to penetrate corporate finance teams signals a deliberate convergence of malware and business email compromise tactics—now mobile-first. Understanding the attack chain is critical for threat hunters and incident responders.

India's cybercrime watchdog has sounded an alarm over a sharp rise in 'Boss Scam' cases—a WhatsApp-based CEO impersonation fraud that is compromising executive accounts and directing finance staff to transfer funds to mule accounts. The Indian Cybercrime Coordination Centre (I4C), a wing of the Ministry of Home Affairs, observed a sudden spike in complaints on the National Cyber Crime Reporting Portal (NCRP) from Delhi, Gujarat, Maharashtra, Rajasthan and other states, prompting it to issue a public warning on 7 August 2026. The scam begins with a deceptively simple vector: a compressed .zip file with names like '0714 Statement of Account.zip', 'RBI.zip', or 'MCA.zip' sent over WhatsApp, SMS or email. When the recipient clicks on the attachment, their WhatsApp account is immediately compromised. The malware then silently forwards the same malicious file to all contacts and groups, often with a note instructing recipients to pass it on to their 'company finance manager for verification' and to open it on a desktop—thus chaining the infection deeper into corporate networks.

“

For cybersecurity professionals, the 'Boss Scam' represents a classic social-engineering attack supercharged by WhatsApp's trusted contact model.

The advanced stage of the fraud exploits the hijacked account's authenticity. Fraudsters either use the compromised WhatsApp of a senior executive directly or covertly save an alternate number in victims' contacts under the executive's name, then issue urgent payment instructions to finance teams. Because the messages come from a trusted contact, or appear to, they bypass normal skepticism. The I4C noted that this modus operandi has been widely reported across India's industrial and commercial hubs, indicating a coordinated campaign targeting professionals and business owners. The use of account statements, RBI (Reserve Bank of India) branding, and MCA (Ministry of Corporate Affairs) filenames adds a layer of social engineering that exploits anxiety about regulatory compliance and financial audits.

This fraud pattern mirrors global Business Email Compromise (BEC) and CEO fraud trends but is specifically weaponized for WhatsApp, which dominates business communication in India. The platform's end-to-end encryption and personal nature make it an ideal channel for deception, as employees often treat WhatsApp messages from a boss as inherently trustworthy. The I4C's warning underscores a broader vulnerability: as organizations increasingly rely on instant messaging for financial approvals, the attack surface expands. No technical sophistication in malware is required—just the ability to craft plausible filenames and exploit human psychology. However, the auto-forwarding capability suggests the file may contain a script or malware that accesses WhatsApp Web or the mobile app's permissions, though the source does not detail the technical exploit.