India's market regulator warned listed companies about a rising cyber fraud where criminals impersonate CEOs using deepfake technology and WhatsApp malware to steal funds.
Alpha Score of 67 reflects moderate overall profile with strong momentum, strong value, weak quality, moderate sentiment.
India's market regulator is warning listed companies and regulated entities about a surge in cyber fraud known as the "Boss Scam," where criminals impersonate chief executives to trick finance executives into wiring money.
The Securities and Exchange Board of India said Friday that the advisory followed a notification from the Indian Cyber Crime Coordination Centre (I4C), which flagged the rising trend. The fraudsters target top officials through email, WhatsApp and other social media, then contact finance employees under a fake identity to demand urgent transfers.
SEBI described two main methods. In the first, fraudsters use deepfake technology – voice cloning, fake video calls and fabricated social media groups – to impersonate a CEO or managing director. The finance employee is told to move money to a specific account and, in some cases, instructed to keep the transaction secret by claiming it involves unpublished price-sensitive information, the regulator said.
In the second method, attackers send a compressed .zip file via message. The file contains a malicious executable along with a Dynamic Link Library file. If opened on a Windows machine, it installs malware that can hijack the user's active WhatsApp Web session. Once inside the finance officer's account, the fraudster contacts other accounts or finance employees to demand payments to mule accounts, according to SEBI.
In some cases where the attackers gain full control of a device, they secretly change the contact list by saving the fraudster's number under the CEO's name, then use that number to issue payment instructions.
SEBI advised companies to verify every payment request received through WhatsApp, email or social media by directly calling the senior official. It also urged organisations not to transfer funds based solely on social media instructions, and not to install executable files from unknown sources without confirming the sender's identity.
The regulator asked companies to report any such fraud by calling the national cybercrime helpline 1930 or filing a complaint through the National Cyber Crime Reporting Portal.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.