This was the alleged modus operandi used to dupe former Member of Parliament Naresh Gujral, son of former Prime Minister I K Gujral. The alleged fraud resulted in the transfer of Rs 7.8 crore through four separate transactions. On Monday, the Intelligence Fusion and Strategic Operations (IFSO) unit of the Delhi Police achieved its first breakthrough in the case with the arrest of a 40-year-old mule account holder from Amritsar. Officers said the fraud operated through two separate chains: one involving those who allegedly deceived Gujral and his company’s employee, and another responsible for routing and laundering the stolen funds through mule accounts. The arrested individual was part of the second layer of the operation, which involved 35 bank accounts spread across the country. Investigators found that the stolen money was initially distributed among four first-layer accounts — two in Maharashtra and one each in Telangana and Andhra Pradesh.

According to police sources, the IFSO unit, which is probing the case, found that the scammers had initially sent the malicious message to one of the company’s directors. Perceiving it as urgent, the director forwarded it to the accountant for further action. As soon as the accountant clicked on the ZIP file, his WhatsApp account was allegedly compromised. The alleged fraudsters then gained control of the account, altered Naresh Gujral’s contact details on WhatsApp, and began sending messages impersonating him. They instructed the accountant to transfer funds through Real-Time Gross Settlement (RTGS), a system used for urgent, high-value bank transactions. Sources said the scammers are targeting high-ranking officials and corporate executives by sending malicious ZIP archives through email or WhatsApp under the guise of urgent regulatory compliance requirements. In some cases, they impersonate officials from the Reserve Bank of India (RBI). The messages typically create a false sense of urgency by providing only a short time window for compliance.

Once the malicious file is executed, malware infects the executive’s Windows device and active WhatsApp Web sessions. This enables the scammers to communicate with subordinate employees while posing as senior executives and to orchestrate fraudulent financial transfers.

Police sources said that after APK-based malware links, ZIP files have emerged as another major tool being used to target high-profile companies. The compressed ZIP archive typically contains a malicious executable (.exe) file along with a dynamic link library (.dll) file. Similar cases have been reported across the country.

Officers said over 100 such complaints have been reported in cities nationwide. The scammers have primarily targeted company owners, CEOs, and senior executives. During the investigation, police found indications that many of these “Boss Scam” operations are being run from Cambodia, among other Southeast Asian countries. Recently, the Indian Cyber Crime Coordination Centre (I4C) has also raised concern regarding the “Boss Scam” or CEO impersonation fraud.