Loading story…
A campaign dubbed Boss Scam is targeting Indian enterprises by hijacking senior executives’ WhatsApp Web sessions and using the real accounts to send fraudulent payment requests. Attackers reportedly lure victims with urgent compliance-themed messages, including notices impersonating regulators such as the Reserve Bank of India, and deliver malicious ZIP archives that executives are tricked into forwarding to finance staff. Indian authorities said the scheme has led to rapid transfers to mule accounts, with some cases involving losses of up to Rs. 2,45,00,000.
The ZIP files contain a legitimate signed executable paired with a malicious DLL that abuses DLL sideloading on Windows. Once executed, the malware can establish persistence, search Chromium-based browsers for active WhatsApp Web sessions, and steal cookies, authentication tokens, IndexedDB data, saved credentials, and encryption material; some reports say the data is archived with tar.exe and exfiltrated over TCP to clone the victim’s session. The attackers then impersonate executives or trusted employees to request wire transfers, spread additional malicious messages, or steal corporate information, and may fall back to saving an attacker-controlled number under the executive’s name if the hijacked session is cut off.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The Indian Cyber Crime Coordination Centre (I4C) warned about a 'Boss Scam' campaign targeting business leaders' WhatsApp Web sessions to enable impersonation, fraudulent transfer requests, and broader organizational compromise. The warning described attackers using phishing emails or WhatsApp messages with ZIP archives that deploy DLL sideloading malware on Windows systems.
Indian authorities cited documented cases in which attackers used hijacked executive WhatsApp sessions to send fraudulent wire-transfer instructions, with transfers of up to Rs. 2,45,00,000 sent to mule accounts within minutes. The campaign relied on regulatory-themed social engineering and malware that stole WhatsApp Web session tokens from compromised Windows devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A rapidly expanding WhatsApp account hijacking campaign, dubbed HackOnChat by CTM360, is targeting users worldwide through a network of deceptive authentication portals and impersonation pages. Attackers exploit WhatsApp's web interface and use social engineering tactics, such as fake security alerts and spoofed group-invite messages, to trick users into compromising their accounts. The campaign leverages thousands of malicious URLs hosted on inexpensive domains, with a surge in activity noted across the Middle East and Asia. Once an account is compromised, attackers use it to target the victim's contacts for further scams, data theft, and extortion, often propagating the attack chain through phishing messages sent from the hijacked account. Research from UC San Diego highlights the broader social engineering strategies employed by scammers, including the use of long, trust-building conversations that often transition to WhatsApp as the preferred platform for executing fraud. The study found that scammers typically delay financial requests until after extensive interaction, using personal conversation and subtle verification techniques to build credibility. These findings underscore the effectiveness of WhatsApp as a tool for scammers and the sophistication of their methods in orchestrating account takeovers and subsequent fraudulent activities.
Jun 29, 2026
A phishing campaign targeting high-profile individuals involved in Iran-related activities has been using WhatsApp messages to lure victims to a fake site that impersonates *WhatsApp Web* and steals access to accounts and other credentials. U.K.-based Iranian activist and investigator **Nariman Gharib** shared the phishing link and technical findings, which indicated the operation aimed to compromise WhatsApp accounts and harvest credentials (including **Gmail** and other online logins), with victims including a Middle Eastern academic in national security studies, the head of an Israeli drone maker, a senior Lebanese cabinet minister, at least one journalist, and individuals with U.S. phone numbers. TechCrunch reported it was able to view a real-time copy of victim submissions because the attackers’ server storing responses was left exposed without a password, showing dozens of victims had entered credentials and were likely subsequently compromised. Technical reporting described the attack as a “surveillance kit” that hijacks accounts by abusing the WhatsApp Web linking flow: the phishing page continuously polls the attacker’s infrastructure and presents a live QR code tied to the attacker’s own WhatsApp Web session, so when a victim scans it they unknowingly authenticate the attacker’s browser and link their account. The infrastructure was reported as hosted on a **DuckDNS** domain and running on an **Ubuntu** server with **nginx**. Beyond account takeover, the kit was described as requesting browser permissions that could enable invasive monitoring—camera, microphone, and location access—allowing attackers to capture photos, record audio in intervals, and track location in near real time; attribution remained uncertain in one report, while another linked the activity to Iranian intelligence.
Jun 29, 2026
A new malware campaign, identified as SORVEPOTEL, has been actively targeting Windows users in Brazil by exploiting the WhatsApp messaging platform as its primary infection vector. The campaign is engineered for rapid propagation rather than data theft or ransomware, focusing on widespread distribution through social engineering tactics. Attackers initiate the infection by sending convincing phishing messages from already compromised WhatsApp accounts, which increases the credibility of the malicious communication. These messages contain ZIP file attachments that masquerade as legitimate documents, such as receipts or health app files, and are specifically crafted to require opening on a desktop, indicating a focus on enterprise environments. Upon opening the ZIP file, victims are prompted to execute a Windows shortcut (LNK) file, which silently triggers the malware installation on the system. Once installed, SORVEPOTEL leverages active WhatsApp Web sessions to automatically send the same malicious ZIP file to all contacts and groups associated with the victim’s account, enabling rapid self-propagation. This automated spamming behavior often results in the infected WhatsApp accounts being banned due to excessive activity. Trend Micro telemetry indicates that out of 477 detected cases, 457 occurred in Brazil, highlighting a strong regional focus. The campaign has notably impacted government and public service organizations, but has also affected entities in manufacturing, technology, education, and construction sectors. While the primary goal appears to be mass distribution, there is concern that similar techniques have previously been used in Brazil to target financial data, raising the risk of future campaigns with more damaging objectives. Researchers have also observed that, in addition to WhatsApp, the attackers may use email as a secondary distribution channel, sending the same malicious ZIP files from seemingly legitimate email addresses. The use of social trust and automation in this campaign demonstrates a sophisticated approach to maximizing infection rates. There is currently no evidence that SORVEPOTEL exfiltrates data or encrypts files, but the potential for further exploitation remains. The campaign underscores the importance of user awareness regarding phishing tactics, especially those leveraging trusted communication platforms. Security teams are advised to monitor for suspicious WhatsApp Web activity and educate users about the risks of opening unsolicited attachments. The incident highlights the evolving threat landscape where messaging platforms are increasingly abused for malware propagation, particularly in regions with high platform adoption.
Jun 29, 2026