The File That Looked Official: How a WhatsApp Takeover Can Become a Corporate Money Trap
Introduction
Imagine an ordinary workday: a finance manager receives a WhatsApp message that appears to come from the company director. A regulatory document must be checked before a payment is released. The file is named “Statement of Account.zip”. The sender is familiar, and the deadline leaves little time to question it. But the archive may contain more than a statement. If a user extracts and runs the malicious Windows file inside, an attacker may compromise the computer and an active WhatsApp Web session. The account can then spread the file or be used for fraudulent payment instructions.
This is an illustrative reconstruction, not the story of one publicly identified victim. It is based on a 7 August 2026 alert from India’s Indian Cyber Crime Coordination Centre (I4C), describing reported WhatsApp takeovers across multiple states. It shows how a visible payment scam may be the final step in a longer technical and social chain. [1]
The real incident: an official warning, not a rumour
On 7 August 2026, I4C, under the Ministry of Home Affairs, warned of a rise in complaints involving professionals and businesses whose WhatsApp accounts were taken over after malicious files were sent as account statements or urgent regulatory notices. Reported filenames included “Statement of Account.zip”, “RBI.zip” and “MCA.zip”, delivered through WhatsApp, SMS or email. I4C said an archive could contain a Windows executable (.exe) and a Dynamic Link Library (.dll); opening the extracted file on a Windows computer could install a Trojan and compromise an active WhatsApp Web session. [1]
The compromised account could then spread the file to contacts and groups. Fraudsters might use an executive’s genuine account - or an attacker-controlled number saved under the executive’s name - to request urgent transfers to mule accounts. I4C identified reports from Delhi, Gujarat, Maharashtra and Rajasthan. It also said over 58,000 potential victims had been alerted by SMS in the preceding 30 days and more than 10,000 people protected through interventions. These are figures reported by I4C at that time, not a count of all victims or losses. [1]
The logical theory: how the attack chain may work
A useful working theory has five stages. It explains the mechanism described by I4C, but it should not be treated as proof that every reported case followed an identical path.
1. Authority creates urgency. I notice that a message borrows the language of compliance, banking or regulation. The aim is to make the recipient act quickly and treat the attachment as business paperwork.
2. A file crosses the boundary. I see that the risky step is not simply receiving a message; the risky step is. Executing the malicious Windows file. The I4C advisory describes an executable paired with a DLL. In DLL sideloading a program loads a library that's malicious or has been placed where it can be loaded unexpectedly. The precise behaviour must be confirmed by examining the sample and system evidence not guessed from a filename. [1][2]
3. The computer becomes the bridge. I read that the public advisory says the malware can compromise the Windows device and hijack a WhatsApp Web session. This means the incident is more than a stolen password: the attacker may be able to act through a session that already appears trusted.
4. Trust helps the file spread. I notice that a file or request arriving from a known colleague is more persuasive than one, from an account. If contacts receive the attachment from a compromised account they may forward it. Open it on a work computer potentially extending the incident.
5. The technical intrusion becomes a payment scam. I see that the attacker uses the authority of the executive’s account to request a transfer. The beneficiary account, transfer timing and messages may become financial evidence alongside the endpoint and messaging records.
How an investigator tests the theory
Start with a timeline, not a suspect. Record when the message arrived, when the archive was downloaded and possibly executed, when unusual messages began, which linked devices appeared, and when a transfer was requested. Note each timestamp’s source and time zone. A message in a chat proves it was present there; it does not, by itself, prove who typed it.
Evidence can contain the archive and its hash; message details or email headers; conversation exports and screenshots; Windows security and antivirus logs; available process and network artefacts; linked-device information; and payment instructions, transaction IDs and beneficiary details. Evidence authors should keep originals record each collection and transfer and analyse copies where possible. Evidence responders must not open a file, on a normal work computer to test it. Evidence NIST guidance explains the care needed to preserve evidence. [3]
Test alternatives as well. Proof of file execution before a new session or unusual outgoing messages may support the theory. Matching hashes across affected systems may link samples, and bank records may help trace payments. But a filename does not prove two files are identical, an IP address does not identify a person, and receiving an archive does not prove it ran. If evidence contradicts the theory, revise it.
What organizations should do now
I4C says that any urgent transfers or changes to bank information should be checked using another way like a phone call or meeting in person. They also say to be careful about opening files or programs that are not confirmed check the devices linked to WhatsApp and make sure Windows computers are safe and up to date. [1] Don't approve any payment just because a message seems to be from a up person.
If you think something is wrong, tell the IT or security team stop using the computer that might be affected follow the steps, for an incident tell people who use the account not to open files from it remove any sessions that are not known and keep any proof before cleaning up. In India you can tell about financial cyber-crime by using the National Cyber Crime Reporting Portal or call 1930 right away. [4]
Conclusion
The I4C warning says that a WhatsApp takeover can happen through a series of events not just because someone stole a password. A convincing message that looks like it comes from a regulator can trick a user into opening a file. Once the file runs the computer might reveal a messaging session. Then the trusted account can spread the threat. Make a fake payment request seem real. Every step, in this process can leave clues: file traces, system logs, session data, messages and money trail evidence.
The I4C warning is not proof of what happened on any device. Investigators should use the I4C warning to build a theory test that theory, against saved records think about possibilities and mark what is unknown. For organisations a quick independent check of payment instructions can prevent the final loss. For investigators careful timelines and proper handling of evidence can produce results that can be explained and defended.
References: -
[1] Press Information Bureau, Ministry of Home Affairs / Indian Cyber Crime Coordination Centre (I4C), “I4C cautions corporates and finance professionals against ‘Boss Scam’: WhatsApp account takeover through malicious ‘Statement of Account’, ‘MCA’ and ‘RBI’ files aimed at high-value financial fraud,” 7 August 2026. Source
[2] Press Information Bureau, Ministry of Home Affairs / I4C, “Regulatory and Executive Impersonation for WhatsApp Account Takeover using Malicious Windows Executables and High value financial fraud,” 22 June 2026. Source
[3] Barbara Guttman, Douglas R. White, Shannan Williams and Tracy Walraven, Digital Evidence Preservation: Considerations for Evidence Handlers, NISTIR 8387, National Institute of Standards and Technology, 2022. Source
[4] Government of India, National Cyber Crime Reporting Portal; the portal advises immediate reporting of financial cyber fraud through helpline 1930. Source
Related Blogs
Introduction
" सर्वे भवन्तु सुखिनः, सर्वे सन्तु निरामयाः " May all be happy, may all be free from suffering. This timeless invocation reflects a vision of collective well-being, where progress is meaningful only when shared, and protection extends to every individual in society. This very philosophy lies at the heart of Corporate Social Responsibility, which seeks to ensure that growth is not isolated or unequal, but inclusive, ethical, and mindful of the broader social good.
At its core, Corporate Social Responsibility is not merely a statutory obligation, it is a reflection of a deeper ethical commitment, an acknowledgement that growth must carry with it a sense of duty towards society. In many ways, CSR embodies the idea that progress without responsibility is incomplete, and that corporations, as key actors shaping modern life, must help safeguard the very communities they engage with.
Reframing Digital Literacy Through Cyber Safety in CSR Frameworks
In India, this moral vision has been given a legal structure under the Companies Act, 2013, CSR Schedule VII, which mandates certain classes of companies to allocate a portion of their profits towards socially beneficial activities. Section 135 of the Act requires companies meeting specified financial thresholds to undertake CSR initiatives, guided by principles of inclusivity, sustainability, and social welfare. The underlying values are clear, CSR is intended not as charity, but as a strategic and accountable contribution to societal development.
Schedule VII of the Act further outlines the broad areas that qualify as CSR, including “Education and Digital Literacy”, gender equality, rural development, and measures for reducing inequalities. Within this framework, promoting “digital literacy” has increasingly been recognised as a legitimate and necessary CSR activity, especially in the context of a rapidly digitising society like India.
However, the current understanding of digital literacy within CSR remains incomplete. It often emphasises access and usage, teaching individuals how to navigate digital platforms, use devices, and engage with online services. What remains insufficiently addressed is the question of safety. In an environment where cyber fraud, data breaches, online harassment, and identity theft are becoming increasingly common, digital literacy without cyber awareness risks becoming a partial and potentially harmful intervention.
Embedding cyber awareness and capacity building within ‘digital literacy’ in explicit form is therefore not optional, it is essential. This includes equipping individuals with the ability to recognise online threats, protect personal data, understand digital consent, and respond effectively to cyber risks. It also requires recognising that vulnerable populations, including first-time internet users, women, and marginalised communities, often face disproportionate exposure to cyber harm.
“It is pertinent to note that Cybersecurity awareness training is relevant to CSR but is not yet consistently implemented as an explicit CSR activity. It is often included indirectly within digital literacy programs, highlighting the need for a more structured, progressive and integrated approach.”
Given this reality, there is a strong case for explicitly recognising cyber awareness as a distinct and integral component of CSR activities, rather than treating it as an implicit subset of digital literacy. Doing so would not only align CSR with contemporary societal risks but also ensure that corporate interventions move beyond enabling access to actively ensuring safety.
In a digital society, empowerment without protection is incomplete. If CSR is to truly reflect its foundational values, it must evolve to address not just the opportunities of the digital age, but also its risks.
Why Cyber Safety Must Be Central to CSR
The current state of digital ecosystems, which used to operate as secondary systems, now functions as essential systems that support government operations, banking systems, educational institutions, and social communication. The digital environment has its vulnerabilities, which create direct dangers for people in society. The elderly, first-time internet users, and rural communities face higher cyber threat risks because they often lack knowledge and protective resources on responsible use. The implementation of CSR initiatives that provide digital access to these groups, along with how to handle risks, will create greater benefit for their safety. Organisations must encourage the implementation of cyber safety training in their CSR programs because doing so will create value while fulfilling their ethical obligations. The empowerment process needs to achieve complete success, which protects people from any potential dangers according to the "do no harm" principle.
Key Components of CyberPeace-Aligned Digital Literacy
To make CSR initiatives more effective and future-ready, organisations should incorporate the following elements into their digital literacy programs:
- Cyber Awareness and Risk Recognition: The training program teaches participants how to recognise typical security threats, which include phishing attacks and scams, deepfake technology and misinformation.
- Data Protection and Privacy Literacy: The program teaches users how to protect their personal information, together with the process of giving consent and the methods used to handle their online presence.
- Responsible Digital Behaviour: The program teaches people how to use the internet responsibly by showing them how to make ethical decisions that require both respect and accountability while understanding the legal consequences of their actions.
- Incident Response and Reporting Mechanisms: The program teaches users about cyber incident response, which includes all reporting methods and available support resources.
- Inclusion-Focused Design: The program develops specific solutions which protect various demographic groups from their particular vulnerabilities while maintaining accessibility and essential programmatic relevance.
Policy and Institutional Alignment
The integration of cyber safety into corporate social responsibility lets organisations achieve their national objectives, which include:
- Strengthening digital trust and resilience
- Supporting safe digital inclusion initiatives
- Complementing the efforts of institutions working on cybersecurity awareness and capacity building
The structured approach requires organisations to execute three specific steps, which include:
- Partnering with cybersecurity organisations and civil society
- Developing standardised cyber awareness modules
- The organisation will use behavioural change indicators to evaluate its impact instead of relying on access metrics.
The Way Forward
Digital-era Corporate Social Responsibility needs to transition from its present state of providing access to digital resources toward establishing secure online platforms for users. The understanding of digital literacy needs to shift from its current status as a technical ability toward its new definition as a social competency that encompasses safety, responsibility and resilience training.
Companies need to understand their digital transformation obligations because their digital transformation efforts require them to handle all associated risks. The implementation of cyber safety within corporate social responsibility frameworks will enable organisations to develop a secure and trustworthy digital environment that includes all users.
Conclusion
The implementation of corporate social responsibility needs to fulfil its core mission of creating societal benefits through inclusive practices that span all current digital possibilities and their associated security threats. The field of digital literacy requires a new framework that combines digital safety practices with its existing educational materials.
The digital safety practice ensures that people obtain essential knowledge and skills that enable them to use digital resources securely when they access online content. The process of accomplishing shared community prosperity needs to establish a framework that benefits every person through social advancement and the protection of their rights.
References
- https://upload.indiacode.nic.in/schedulefile?aid=AC_CEN_22_29_00008_201318_1517807327856&rid=79
- https://www.allresearchjournal.com/archives/2025/vol11issue4/PartF/11-5-60-511.pdf
- https://www.unesco.org/en/dtc-finance-toolkit-factsheets/corporate-social-responsibility-csr
- https://www.investopedia.com/terms/c/corp-social-responsibility.asp
- https://digitalmarketinginstitute.com/blog/corporate-16-brands-doing-corporate-social-responsibility-successfully
- https://www.imd.org/blog/sustainability/csr-strategy/
Executive Summary
A video circulating on social media shows Dr. Vikas Divyakirti speaking during a podcast, where he is heard saying, “Those who cannot even memorise and speak four sentences are considered the greatest in India.” Several users are sharing the clip claiming that the remark was aimed at Narendra Modi. However, a research by CyberPeace found the claim to be misleading. The research revealed that the viral clip has been edited and shared out of context. In the original video, Divyakirti made the remarks in reference to film stars, not the Prime Minister.
Claim
On Facebook, a user shared the viral clip with an English caption alleging that Divyakirti criticised Modi, saying he cannot speak without a teleprompter or scripted interviews and has built a false image of greatness.
Similarly, another user shared the video on X, suggesting that people who cannot speak without a teleprompter are still considered great in India, indirectly linking the remark to Modi.
Fact Check
To verify the claim, we extracted keyframes from the viral video and conducted a reverse image search using Google Lens. This led us to the original video uploaded on the official YouTube channel of Raj Shamani.
At around the 3:55 mark, the same clip can be seen. During the conversation, Shamani asks whether building a larger-than-life perception actually benefits an individual. Responding to this, Dr. Vikas Divyakirti explains that film stars often have an exaggerated public image. He notes that many of the dialogues they are praised for are not written by them, but by others, and some even rely on teleprompters while speaking. He further adds that there are individuals who cannot even memorise and deliver four sentences or think independently, yet are regarded as great in India. He also mentions that many social media personalities use teleprompters, but audiences remain unaware and assume they possess exceptional knowledge.
Conclusion
The viral claim is misleading. The video has been edited and shared out of context. Dr. Vikas Divyakirti was referring to film stars and social media personalities, not Narendra Modi.
Executive Summary
A claim is being shared on social media alleging that two women were shot dead and their homes were set on fire in Manipur. The post alleges that the Indian Army carried out the attack on the orders of Lieutenant General V. M. Bhuvana Krishnan, Commander of the Eastern Command. CyberPeace Research found the claim to be false. According to available reports, suspected militants attacked a hill village in Manipur’s Kangpokpi district. During an exchange of fire with security forces, the attackers set at least two houses on fire.
Claim:
The Indian Army, on the orders of Eastern Command Commander Lieutenant General V. M. Bhuvana Krishnan, shot two women in Manipur and set their homes on fire, following which the situation in the state deteriorated severely.
https://x.com/indiantiwari01/status/2100204995425743103?s=20
https://archive.ph/SOm7I
Fact Check
To verify the viral claim, we conducted a Google search using relevant keywords. During the search, we found a report published on The Times of India website on September 16, 2026. According to the report, suspected militants attacked a hill village in Manipur’s Kangpokpi district on Tuesday night and set at least two houses on fire. Security forces engaged the attackers in an exchange of fire during the incident.According to officials, a large number of militants armed with sophisticated weapons attacked Chawangkining Naga village at around 10:30 p.m. on Tuesday. The attack took place hours after two Kuki women were shot dead at Leisangphai village in neighbouring Tamenglong district.CRPF personnel deployed in the nearby area returned fire, triggering intermittent firing that continued for nearly six hours until around 4:30 a.m. on Wednesday.An official said, “Intermittent firing was reported for nearly six hours till 4:30 a.m. on Wednesday. The CRPF returned fire, preventing the militants from entering the village.” He added that two wooden houses on the outskirts of the village were nevertheless set ablaze.
As part of our further investigation, we conducted a reverse image search of keyframes from the video. During the search, we found the visuals from the viral video on the YouTube channel of @ukhrultimes. According to the accompanying information, intermittent firing continued for nearly six hours in Chawangkining Naga village in Manipur’s Kangpokpi district on the night of September 15, 2026. During the incident, two houses on the outskirts of the village were completely burnt down, while several others were damaged.According to local reports, suspected militants targeted the village despite the deployment of CRPF personnel in the area and engaged in an exchange of fire with security forces. Meanwhile, the Liangmai Naga Council, Manipur (LNC-M), condemned the attack and alleged that suspected Kuki militants operating from the Songtung Suspension of Operations (SoO) camp were behind the firing. However, these allegations regarding the identity of the attackers should be reported as allegations and should not be presented as independently verified facts.
https://www.youtube.com/shorts/QuZ2FoLyA5A
At the end of our investigation, we found a report published on The Hindu website on September 16, 2026. According to the report, officials said that suspected militants had attacked Chawangkining Naga village in Manipur’s Kangpokpi district. During the attack, they engaged in an exchange of fire with security forces and set at least two houses on the outskirts of the village on fire. The report quoted an official as saying that a large number of militants armed with sophisticated weapons attacked the village at around 10:30 p.m. on September 15. The incident took place hours after two Kuki women were shot dead in Leisangphai village in neighbouring Tamenglong district.
Conclusion
Our investigation revealed that separate incidents of the killing of two women and the burning of their houses in Manipur are being falsely shared on social media, claiming them to be actions taken by the Indian Army. According to available reports, on September 15, 2026, two Kuki women were shot dead by unidentified armed assailants in Leisangphai village, Tamenglong district. On the same night, suspected militants attacked Chawangkining Naga village, Kangpokpi district. Security forces exchanged fire, and two houses on the outskirts of the village were set on fire. No credible report has confirmed the links between these incidents and the orders of the Indian Army or Eastern Command Commander Lieutenant General V.M. Bhuvana Krishnan. Therefore, the claim that the Indian Army shot two women and set their houses on fire by linking the two incidents is false and misleading.
