India

CEO Impersonation Fraud and Cybercrime Schemes

Tuesday, June 23, 2026
5 min read
CEO Impersonation Fraud and Cybercrime Schemes

The Ministry of Home Affairs stepped in. They warned everyone about a new way criminals are operating using the names of high-ranking officials to pull this stuff off. It’s all about fraud now.

I4C, that’s the Indian Cyber Crime Coordination Centre, they issued an advisory. It’s flagged these fraudulent emails and WhatsApp messages. They look exactly like they’re coming from the RBI or some other regulator. The target? CEOs, top executives. The whole setup is designed to compromise subordinates so those big financial transfers happen.

The NCTAU at I4C noticed this trend. They call it the “Boss Scam” or CEO impersonation fraud. Cybercriminals are hitting these high-ranking folks directly. They send malicious archives through email or WhatsApp. The cover story? Urgent regulatory compliance. Sounds official enough, right?

But that’s just the start of the mess. Once you click something, once the message is acted on that’s when things go sideways fast. The malware hits the executive’s Windows desktop or laptop. It establishes a foothold. And it hijacks whatever active WhatsApp sessions are running. They get into the session tokens.

Then comes the real trickery.

Initial contact happens through email or WhatsApp. Sophisticated criminals pose as the Reserve Bank of India, demanding immediate action because there's some violation or urgent security fix needed. It pushes for a response right now. Very short timeframe looming.

Inside those messages? They don’t send plain text. They pack it up a compressed .zip archive. Inside that file, you find the nasty stuff: an executable file, an .exe, and a DLL.

Investigators have seen this pattern before. People forward these scary messages around. CEOs forwarding things to finance officers. That's how the chain starts moving. Systems get compromised one by one.

When someone finally extracts and runs that file on their desktop that’s when the Trojan dropper kicks in. It locks down the system, takes control of everything. The malware sets up a persistent hold. And it hijacks those session tokens we talked about earlier. Everything is now under criminal control.

Then they move to the money. This stage is where the actual fraud explodes. Once the fraudsters have access to the executive’s real WhatsApp account or whatever digital key they managed to snag they contact accounts or finance staff directly. They tell them, "Move this money now ." Into specific mule bank accounts.

There's another variant too. Some reports suggest something even sneakier happens after the device takeover. The fraudsters might secretly change the phone’s contact list. Save a fake number under the CEO’s name. A secondary line. Then they use that to instruct employees about fund transfers. It makes it look like an internal, urgent order.

I4C is pushing back now. They are telling Finance departments: stop. Stop verifying any request for money or account changes based only on a WhatsApp text or email. You need confirmation. A direct voice call. In-person confirmation. That’s the line they want you to hold onto right now.

Written by Gree News Team — Senior Editorial Board

Gree News Team covers international news and global affairs at Gree News. Our collective of senior editors is dedicated to providing independent, accurate, and responsible journalism for a global audience.

#sensational#india#global#trending

More from India

View All

Latest Headlines