Got an urgent WhatsApp from boss? Could be a scam
What's the story
The Securities and Exchange Board of India (SEBI) has issued a warning about a new cyber fraud targeting finance employees in Indian companies. The scam, dubbed the "Boss Scam" or CEO impersonation fraud, involves a perpetrator posing as a company's CEO or Managing Director (MD) and requesting an urgent fund transfer. The unsuspecting employee complies with the request, leading to financial loss for the company.
Rising trend
Advisory issued to all listed companies
SEBI's warning comes after the Indian Cyber Crime Coordination Centre (I4C) reported a spike in such cases.
Fraudsters are targeting finance executives via email, WhatsApp, and other social media platforms.
They impersonate senior company officials and instruct employees to transfer money to accounts controlled by them.
The advisory was issued to all listed companies and regulated entities in India.
Scam tactics
Cybercriminals use AI to impersonate CEOs
SEBI has identified two main tactics employed by cybercriminals to execute this fraud.
The first one uses artificial intelligence (AI) technology such as voice cloning, deepfake video calls, and fake social media groups to convincingly impersonate a CEO or MD.
Once an employee is convinced they are communicating with their boss, they are instructed to transfer funds to a specified bank account.
Technical approach
Second method involves sending malicious files
The second method is more technical and involves fraudsters sending a compressed.zip file via message.
This file contains a malicious executable file and Dynamic Link Library (DLL) file.
If opened on a Windows PC, it installs malware that hijacks an active WhatsApp Web session.
Once they gain access to a finance officer's WhatsApp account, they use it to send payment instructions to other employees.
Prevention measures
SEBI's advice for companies and employees
In light of these scams, SEBI has advised companies to cross-verify any payment requests received through WhatsApp, emails, or social media.
This should be done by directly calling the senior official in question before acting on it.
Employees are also advised not to open executable files from unknown or unverified sources and log out of inactive WhatsApp Web sessions for added security.