I4C Boss Scam warnings are now being sent to potential victims after a sharp rise in malicious ZIP-file attacks that can hijack active WhatsApp Web sessions on Windows computers. The Indian Cyber Crime Coordination Centre says files disguised as Statement of Account.zip, RBI.zip and MCA.zip have been used to compromise business users, spread automatically through genuine WhatsApp accounts and trigger urgent fake payment instructions to finance teams.
The August 7, 2026 I4C update says more than 58,000 potential victims were intimated through the SMS header I4CMHA-G during the previous 30 days, while more than 10,000 Indians were protected through coordinated intervention. The immediate reader question is not simply “is this a scam?” but what to do if the file was received, opened, forwarded or followed by a payment demand.
WhatsApp security guides
If your concern is broader than this specific I4C malware campaign, use our Someone Reading My WhatsApp? diagnostic guide to check whether another device may have access. If the issue involves QR pairing, Web Scanner apps or companion-device access, see Can Someone Clone Your WhatsApp?. If you received a phone-number verification code you did not request, use WhatsApp Verification Code I Didn’t Request. If you have already lost control of the account, follow our Recover a Hacked WhatsApp Account recovery guide.
Direct answer
Received RBI.zip, MCA.zip or Statement of Account.zip?
Do not download, extract or execute the file unless it has been independently verified. I4C says this campaign uses malicious Windows executables inside ZIP archives to compromise devices and hijack active WhatsApp Web sessions.
Current status
Fresh national warning issued August 7
I4C says complaints have risen sharply and recent incidents with the same modus operandi have been reported from Delhi, Gujarat, Maharashtra and Rajasthan. Potential victims are being contacted through the SMS header I4CMHA-G.
Confirmed by I4C
- The malware activates on Windows computers.
- Active WhatsApp Web sessions can be hijacked.
- Compromised genuine WhatsApp accounts can propagate the malicious file.
- Attackers impersonate RBI and MCA communications; Income Tax impersonation has also been observed.
- More than 58,000 potential victims were intimated through
I4CMHA-Gin 30 days. - More than 10,000 Indians were protected through coordinated intervention.
Do not overstate
- The 58,000 recipients are not confirmed to be 58,000 infected users.
- I4C has not publicly identified the exact countries operating the networks.
- No verified total monetary-loss figure is stated in the August 7 release.
- The specific malware described by I4C activates on Windows; do not claim Android or iPhone infection from this evidence alone.
Table of contents
- What is the I4C Boss Scam?
- How the malware works
- Can a real boss account be compromised?
- What is an I4CMHA-G SMS?
- What to do if you opened the ZIP
- What if you received a verification code?
- What if money was transferred?
- Finance-team controls
- Known lure filenames
- Official sources
- Related WhatsApp security guides
- Verification notes
- Limitations
- FAQs
I4C Boss Scam: what exactly is happening?
The Boss Scam is a CEO or senior-executive impersonation fraud. In the current campaign, criminals first try to compromise a Windows device belonging to an executive, professional or business user through a malicious ZIP archive. The lure may look like an account statement or an urgent regulatory communication.
I4C says the archive contains a malicious Windows executable accompanied by a DLL file. If the victim extracts and opens the executable, a Trojan can compromise the Windows computer and hijack the active WhatsApp Web session.
That changes the trust problem significantly: the next fraudulent message may come from the executive’s genuine compromised WhatsApp account, not merely a lookalike number.
Editorial interpretation
“Check whether the WhatsApp number belongs to your boss” is no longer sufficient as a payment control in this campaign. The transaction itself should be verified through a separate trusted channel such as a direct voice call or in-person confirmation.
How the I4C Boss Scam malware chain works
Regulatory lure
The victim receives a ZIP over WhatsApp, SMS or email, often disguised as an account statement or RBI/MCA communication.
Windows execution
The ZIP contains an executable and DLL. Opening the malicious executable can install a Trojan on the Windows system.
WhatsApp Web takeover
The malware can hijack an active WhatsApp Web session on the compromised computer.
Automatic propagation
The genuine account may send the same malicious archive to contacts and groups, extending the infection chain.
Executive impersonation
Fraudsters can use the compromised account or manipulate saved contacts so an attacker-controlled number appears under the CEO’s name.
Payment instruction
Finance or accounts staff receive an urgent instruction to transfer money to mule bank accounts.
Can the I4C Boss Scam use your boss’s real WhatsApp account?
Yes. I4C explicitly says the fraudsters can use a senior executive’s genuine WhatsApp account after the active WhatsApp Web session is hijacked. In another variant, an attacker with deeper device access may alter contacts so a fraudulent phone number is stored under the CEO’s name.
That creates two separate questions: whether an account is currently being accessed and how that access happened. If you suspect another person or device can currently see messages, use our WhatsApp unauthorized-access diagnostic guide. If the concern involves QR pairing, companion devices, Web Scanner tools or something described as a “clone,” see our WhatsApp clone and linked-device explainer.
For finance teams, that means the authenticity of the sender account is not enough to authorise an unusual transfer, bank-account change or urgent payment.
I4C Boss Scam warning: what is an I4CMHA-G SMS?
I4C says it is sending alerts to affected citizens through the SMS header I4CMHA-G. More than 58,000 potential victims were intimated using that header during the previous 30 days.
Receiving the SMS should be taken seriously, but the August 7 release does not establish that every recipient’s computer was successfully infected. I4C says victims and potential victims are identified through complaint analysis and technical intelligence.
Important distinction
An I4CMHA-G alert means I4C has identified a reason to warn the recipient. It should not be interpreted as proof of infection unless the alert or a subsequent investigation confirms that.
I4C Boss Scam response: what to do if you opened the ZIP
If a suspicious ZIP was extracted and its executable opened on a Windows computer, I4C’s guidance supports treating both the endpoint and its active WhatsApp Web session as potentially compromised.
| Situation | Immediate action | Why |
|---|---|---|
| ZIP received but not opened | Do not extract or execute it; independently verify the sender and purpose | Prevents the malicious executable from running |
| Executable was opened on Windows | Have the computer scanned using updated anti-malware and involve IT/security where available | I4C says execution can install a Trojan |
| WhatsApp Web may be compromised | Open WhatsApp Settings > Linked Devices and log out linked sessions, especially unknown or unused sessions | I4C specifically recommends reviewing and logging out linked devices |
| Malicious file was sent from your account | Warn contacts and groups not to open the file | The malware can propagate through compromised accounts |
| Urgent payment request received | Verify through direct voice call or in-person confirmation | I4C recommends out-of-band verification |
| Corporate Windows device involved | Escalate to the organisation’s IT/security team | The infection can expose a business endpoint and messaging session |
If WhatsApp access is already compromised
Logging out an unfamiliar Linked Device is only one part of the response. If you have been logged out of WhatsApp, cannot receive the verification code, see repeated takeover, or need to regain control of the account, use the separate Recover a Hacked WhatsApp Account: 9 Critical Steps guide.
What if you received a WhatsApp verification code during this incident?
An unexpected phone-number verification code is not the same evidence as the Windows malware chain described in the I4C Boss Scam warning.
The Boss Scam evidence on this page concerns malicious Windows files, compromise of the computer and hijacking of an active WhatsApp Web session. A separate phone-number verification or registration event should be assessed on its own evidence.
Separate the two events
If you received a WhatsApp verification code you did not request, but you are still logged in and do not know whether an account-registration attempt succeeded, use our WhatsApp Verification Code I Didn’t Request guide. It explains attempt versus successful takeover, repeated codes, logout, SIM problems and the difference between phone-number verification and device-linking codes.
If the unexpected code is followed by loss of account access, move to the WhatsApp account recovery guide.
I4C Boss Scam: what if money has already been transferred?
I4C says cyber fraud and suspicious communications of this type should be reported immediately through the National Cyber Crime Helpline 1930 or the National Cyber Crime Reporting Portal.
If company funds have already moved, the organisation should also contact its bank/payment provider immediately through its known official channel and preserve payment references, beneficiary details, messages, screenshots and relevant device evidence. Speed matters, but neither I4C nor this article can guarantee recovery of transferred money.
What finance teams should change immediately
The campaign exploits urgency and organisational hierarchy. I4C therefore advises corporate entities to sensitise employees, particularly finance teams, and independently verify urgent fund transfers and account-change requests through a direct voice call or in-person confirmation.
No WhatsApp-only approvals
Do not authorise an unusual payment merely because the instruction came from a known executive account.
Separate verification channel
Confirm urgent transfers through a known phone number, voice call, approved workflow or in person.
Restrict unknown executables
I4C recommends software restriction policies and current anti-malware protection on Windows endpoints.
SEBI had separately warned regulated entities and listed companies about Boss Scam fraud in July 2026, reinforcing the need for direct verification of digital payment instructions. For other current regulatory implementation updates, ThePulseSignal maintains its SEBI PaRRVA deadline tracker.
Which filenames has I4C specifically identified?
The August 7 I4C release identifies examples including:
Statement of Account.zip- date-prefixed account-statement ZIP files such as
0714 Statement of Account.zip RBI.zipMCA.zip
These examples should be treated as known lures, not as a complete malware filename list. A different filename can still be malicious, while a filename alone does not prove that a particular file contains malware.
Official I4C and cybercrime sources
- I4C / Ministry of Home Affairs Boss Scam update dated August 7, 2026
- I4C advisory dated June 22, 2026 on regulatory and executive impersonation
- National Cyber Crime Reporting Portal
Related WhatsApp security guides
Diagnosis
Someone Reading My WhatsApp?
Use this diagnostic guide if you suspect unauthorized access but do not yet know whether the cause is a linked device, QR pairing, physical phone access, desktop exposure or another security route.
Unexpected verification code
WhatsApp Verification Code I Didn’t Request
Use this if the main event is an unexpected or repeated verification code and you need to distinguish an attempted registration from stronger evidence of successful account takeover.
QR / linked-device mechanism
Can Someone Clone Your WhatsApp?
Explains companion devices, QR linking, Web Scanner apps, GhostPairing and the difference between linked-device access and full account takeover.
Account recovery
Recover a Hacked WhatsApp Account
Use this when account compromise has already happened and you need to regain control, deal with missing verification codes, remove unauthorized access or investigate repeated takeover.
How this was verified
ThePulseSignal checked the August 7, 2026 Ministry of Home Affairs / PIB release carrying the latest I4C warning. The release was used to confirm the current lure filenames, Windows execution path, WhatsApp Web session takeover, self-propagation behaviour, target audience, I4CMHA-G alert header, 58,000-plus intimations and 10,000-plus protected users.
The earlier June 22 I4C advisory was separately checked to confirm the original Boss Scam workflow: malicious ZIP delivery, Windows executable/DLL payload, WhatsApp Web session-token hijack, fraudulent transfer instruction and contact-manipulation variant.
The National Cyber Crime Reporting Portal was checked to confirm the official reporting destination. Secondary media was used only for competitor and context analysis, not for the central technical claims.
Last verified: August 7, 2026, approximately 4:15 PM IST.
Limitations and unresolved facts
- I4C has not stated that every person receiving an
I4CMHA-GSMS was infected. - No verified aggregate financial-loss figure is given in the August 7 release.
- The exact countries from which the organised networks operate are not identified.
- Exact command-and-control indicators are not published in this article.
- The current advisory specifically describes malware execution on Windows computers; it does not establish independent Android or iOS infection by this malware.
- RBI, MCA and Income Tax Department systems are being impersonated; the source does not say those government systems were breached.
- An unexpected WhatsApp phone-number verification code is a separate account-security signal and does not by itself prove involvement in this Windows malware campaign.
- Reporting quickly to a bank, 1930 or NCRP improves the response path but does not guarantee recovery of funds.
Frequently asked questions
What is the I4C Boss Scam?
It is a CEO/executive impersonation fraud in which malicious Windows files can compromise a device and active WhatsApp Web session, enabling fraudulent payment instructions.
Is RBI.zip received on WhatsApp genuine?
I4C specifically identifies RBI.zip as one of the lure names used in the campaign. RBI does not distribute software updates, security fixes or account statements through WhatsApp attachments.
What is I4CMHA-G?
It is the SMS header I4C says it is using to send alerts to affected citizens and potential victims.
Does an I4CMHA-G SMS mean my computer is infected?
Not necessarily. I4C says victims and potential victims are being intimated based on complaint analysis and technical intelligence.
Can the scam use my boss’s genuine WhatsApp account?
Yes. I4C says an active WhatsApp Web session can be hijacked and the genuine account then misused.
What should I do if I opened the ZIP?
Review and log out WhatsApp linked devices, alert contacts if files were sent from your account, and have the Windows computer scanned with updated anti-malware. Corporate users should involve IT/security. If you have lost control of WhatsApp itself, use our hacked WhatsApp account recovery guide.
I received a WhatsApp verification code I did not request. Is that part of the Boss Scam?
Not necessarily. The I4C Boss Scam evidence described here concerns malicious Windows ZIP files and hijacked WhatsApp Web sessions. An unexpected phone-number verification code is a separate account-security event. Use the WhatsApp Verification Code I Didn’t Request guide to assess that event.
Does the malware affect Android or iPhone?
The specific I4C campaign described here activates on Windows computers. The current evidence does not establish independent Android or iOS infection by this malware.
What if money has already been transferred?
Contact the bank or payment provider immediately and report the cyber fraud through 1930 or the National Cyber Crime Reporting Portal.
How should finance teams verify urgent payment instructions?
I4C recommends a direct voice call or in-person confirmation rather than acting solely on WhatsApp or email instructions.
Are RBI or MCA systems hacked?
The advisory says criminals are impersonating RBI and MCA communications. It does not say those government systems were breached.