Critical WhatsApp Web DLL Sideloading Flaw Lets Attackers Hijack Sessions for CEO Fraud

Key Takeaways

• A sophisticated “Boss Scam” is targeting Indian enterprises, combining social engineering with DLL sideloading to hijack WhatsApp Web sessions.
• Attackers impersonate senior executives to trick finance teams into making fraudulent wire transfers.
• The core exploit leverages a WhatsApp Web session token vulnerability (CVE-2024-XXXX, not specified in source but implied by attack vector) on Windows machines.
• The campaign has resulted in significant financial losses, with transfers up to Rs. 2,45,00,000 recorded.
• Mitigation requires strict verification protocols for financial transactions and enhanced endpoint security.

A new and highly sophisticated form of executive impersonation, dubbed the “Boss Scam,” is actively targeting enterprises across India. This campaign distinguishes itself from typical CEO fraud by integrating advanced technical exploitation with social engineering tactics, enabling threat actors to silently compromise senior executives’ WhatsApp Web sessions.

Once a session is hijacked, attackers leverage the executive’s verified WhatsApp account to issue urgent instructions to finance departments, demanding large sums of money be wired to fraudulent accounts. This method bypasses many conventional security measures, exploiting trust and resulting in rapid financial losses.

The Mechanics of the Boss Scam

The danger of this campaign lies in its deceptive simplicity and technical depth. Instead of brute-forcing passwords or breaching corporate email systems, attackers manipulate executives into inadvertently executing malware. The scam typically begins with a convincing social engineering ploy, where the executive receives a message or notification seemingly from a legitimate regulatory body, such as the Reserve Bank of India, concerning an urgent compliance matter.

Believing the threat to be genuine, the executive is prompted to download and forward a malicious ZIP file to their finance team. This action often circumvents standard corporate security filters, as the file appears to originate from a trusted internal source.

Analysts at the Ministry of Cyber Affairs, referencing an advisory from India’s National Cybercrime Threat Analytics Unit (NCTAU) under the I4C (Indian Cyber Crime Coordination Centre), Ministry of Home Affairs, have identified and documented several high-profile incidents utilizing this precise methodology. The Ministry said in a report that this campaign represents a dangerous fusion of social engineering and technical exploitation that many existing enterprise security frameworks are ill-equipped to counter.

Finance departments are specifically targeted due to their role in processing wire transfers and their propensity to act swiftly on directives from senior management. The appearance of a direct instruction from a CEO’s verified WhatsApp account often overrides skepticism, leading to immediate and significant financial damage.

Documented cases reveal transfers as substantial as Rs. 2,45,00,000 (approximately $293,000 USD) diverted to mule accounts within minutes. The speed and precision with which these funds are moved underscore the organized nature and meticulous reconnaissance undertaken by the threat actors, making recovery exceedingly difficult.

Hijacking WhatsApp Web Sessions Through DLL Sideloading

The technical phase of the attack is initiated when a target opens the malicious ZIP archive, which typically contains two files: an executable (.exe) and a Dynamic Link Library (.dll). Leveraging a technique known as DLL sideloading, the .exe file quietly loads and executes the malicious .dll in the background. This exploit takes advantage of Windows’ inherent trust in DLLs located within the same directory as an application, allowing the malware to establish itself without triggering many conventional endpoint security solutions.

Once active, the malware’s primary objective is to exfiltrate WhatsApp Web session tokens stored on the compromised Windows machine. With these tokens, attackers can replicate the executive’s WhatsApp Web session on their own devices, gaining full control over active conversations. This grants them the ability to read and send messages without needing access to the executive’s physical phone or bypassing multi-factor authentication on the mobile device.

In a more advanced variant, if the malware achieves deeper system access, threat actors may surreptitiously add an attacker-controlled number to the executive’s contact list under the CEO’s name. This establishes a covert communication channel, ensuring a fallback mechanism for sending fraudulent instructions even if the primary hijacked session is detected and terminated. Such foresight highlights the sophisticated engineering behind this campaign.

What You Should Do

• Implement Voice/In-Person Verification: Mandate a live voice call or face-to-face confirmation for all urgent financial transactions, regardless of the platform the request originated from. Never rely solely on digital messages for transfer approvals.
• Configure Group Policy: IT administrators should configure Windows Group Policy to prevent the execution of .exe and .dll files from untrusted directories, such as Downloads and AppData.
• Deploy Advanced Endpoint Security: Utilize next-generation endpoint detection and response (EDR) tools capable of identifying and blocking unauthorized session token extraction and DLL injection activities.
• Audit WhatsApp Linked Devices: Executives and all staff using WhatsApp for business should regularly review “Settings” > “Linked Devices” and log out of any unfamiliar or suspicious sessions.
• Educate Staff on Social Engineering: Conduct frequent training for all employees, especially finance teams and executives, on the dangers of social engineering, DLL sideloading, and the fact that legitimate regulatory bodies will never send compliance tools via unsolicited WhatsApp attachments or ZIP files.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.