Warning Issued: Rising WhatsApp Account Takeovers Targeting Professionals
The Indian Cyber Crime Coordination Centre (I4C), part of the Ministry of Home Affairs, has issued a troubling alert regarding a significant uptick in complaints related to the takeover of WhatsApp accounts among professionals and businesspeople. This alarming trend has been observed via the National Cyber Crime Reporting Portal (NCRP), with reports surfacing from various states including Delhi, Gujarat, Maharashtra, and Rajasthan. The I4C’s advisory, released on June 22, 2026, highlights the growing threat of malicious files masquerading as important regulatory communications and account statements.
In these incidents, victims receive seemingly innocuous compressed files labeled like **“Statement of Account.zip”** or **“RBI.zip”**, often accompanied by messages designed to mimic urgent notices from reputable bodies such as the Reserve Bank of India (RBI). These messages erroneously request immediate action, which may lead to disastrous consequences when the files are opened on a Windows device. Inside these archives, malicious executables and supporting files lurk, capable of installing a Trojan that compromises the user’s device and hijacks their active WhatsApp sessions.
Propagation and Damage
Once a WhatsApp account is compromised, the fraudster can easily disseminate the same malicious file to all of the victim’s contacts, disguised as a request for verification from a _“company finance manager.”_ This method of attack not only infiltrates personal networks but can extend its reach into corporate environments. In very advanced stages, this scheme commonly known as the **“Boss Scam**” or CEO impersonation fraud, enables scammers to instruct financial personnel within an organization to transfer funds urgently to mule accounts.
Technical Insights and Investigations
Technical analysis by the National Cybercrime Threat Analytics Unit (NCTAU) indicates that these attacks are being orchestrated by organized networks that operate beyond national borders, employing sophisticated malware and techniques like DLL Sideloading. Currently, investigations are underway in collaboration with law enforcement and technical agencies to trace the culprits behind this cybercrime wave.
Proactive Measures by I4C
To combat this rising threat, I4C has implemented several measures. They are proactively notifying potential victims identified through their analyses so that corrective actions can be undertaken promptly. Moreover, I4C has shared malware threat signals with organizations like CERT-In and leading antivirus firms to promote swift detection and mitigation of such files.
Over the last month, I4C has issued alerts to more than 58,000 citizens using the SMS header ‘I4CMHA-G’. These alerts advise recipients to remain vigilant against suspicious communications related to account management.
Precautions for Citizens and Organizations
I4C urges both individuals and companies to adopt precautionary measures against these threats:
- Avoid downloading and opening .zip files or unfamiliar executables, especially those received from untrusted sources.
- Regularly review linked devices in WhatsApp and log out of any sessions that are not actively in use.
- Companies should implement software restrictions to prevent unknown files from being executed on user systems and ensure all systems have updated antivirus protection.
- In the event of account compromise, promptly log out of all linked devices, notify contacts, and conduct a thorough malware scan of the impacted computer.
Any suspicious activity or cyber fraud should be reported immediately by calling the National Cyber Crime Helpline at **1930** or visiting the National Cyber Crime Reporting Portal at **www.cybercrime.gov.in**. Detailed guidelines and precautions are available on the portal to assist citizens in safeguarding themselves against these pervasive threats.
Observer Voice is the one stop site for National, International news, Sports, Editor’s Choice, Art/culture contents, Quotes and much more. We also cover historical contents. Historical contents includes World History, Indian History, and what happened today. The website also covers Entertainment across the India and World.
