Boss Scam Uses DLL Sideloading to Hijack WhatsApp Web and Defraud Enterprises

The new “Boss Scam” is a sharp escalation in CEO fraud: attackers now combine impersonation, Windows DLL sideloading, and WhatsApp Web session theft to turn trusted executive channels into fraud infrastructure.

The campaign was highlighted in advisories tied to India’s I4C and NCTAU, which warned that attackers pose as regulators or senior bosses, deliver malicious archives, and then use the compromised account to push fraudulent payment instructions.

At a technical level, the attack chain is built for speed and stealth. Victims receive a ZIP file access containing an EXE and a DLL; when the EXE is launched, Windows loads the malicious DLL from the same directory, a classic sideloading pattern that helps the malware blend in and evade basic file-based controls.

The lure is social engineering first, malware second: the message often claims urgent regulatory action, which pressures executives or finance staff to open the file and forward it internally without scrutiny.n

Once inside the endpoint, the malware’s goal is not ransomware-style disruption. Instead, it looks for active WhatsApp Web sessions and associated authentication material so it can clone the session on the attacker side and read or send messages as the executive without needing to defeat mobile MFA.

That matters because finance teams frequently trust messages that appear to come from a known executive profile, especially when the channel is WhatsApp and the request is framed as urgent.

According to Cyber Affairs, Using the hijacked WhatsApp Web session, the attacker issues payment instructions to employees, often with language that mirrors a real executive’s tone and timing.

Boss Scam Uses DLL Sideloading

In some variants, the malware also alters local contact data so the attacker-controlled number is saved under the CEO’s name, preserving the impersonation even if the web session is detected and logged out.

Threat actors contact C-suite executives or high-ranking officials via email or WhatsApp, impersonating regulatory bodies such as the Reserve Bank of India (RBI).

The result is a hybrid BEC operation: technical compromise creates the trust signal that the business process relies on.

This campaign is important because it targets the weakest junction in enterprise defense: the overlap between personal messaging, executive authority, and payment approval workflows.

It also shows how outdated assumptions about “safe” attachments still fail, especially when unverified EXE and DLL files are allowed to run from user directories such as Downloads or AppData.

In practice, a single compromised endpoint can become a fraud relay for the entire organization.

Defenses need to be equally layered. I4C’s guidance stresses out-of-band verification for all urgent transfers, direct voice or in-person confirmation for bank-account changes, and immediate rejection of unsolicited software updates or compliance tools delivered through WhatsApp.

Enterprises should enforce software restriction policies, monitor for suspicious DLL loads and token theft behavior, and routinely audit WhatsApp Linked Devices on executive phones.

A useful parallel for defenders is the broader trend seen in other malware families that abuse WhatsApp Web session data for propagation, which confirms this is becoming a repeatable abuse pattern rather than a one-off tactic.

The larger lesson is simple: executive fraud is no longer just a mail problem. When attackers can hijack the executive’s messaging identity itself, security teams must treat WhatsApp Web, endpoint execution controls, and payment verification as one connected attack surface.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.