According to investigators, the attack typically begins when a target opens a malicious file or link by accident. (Representative Image)In a highly invasive form of whale phishing attacks, cyber fraudsters have started to hack into computers of senior finance executives of private companies, alter contact details of their bosses and use the compromised devices to send messages, seeking transfers of large sums of money. Cyber investigators from Pimpri Chinchwad and Pune came across half a dozen such cases, where fraudsters hijacked active WhatsApp Web sessions, allowing them to access existing conversations and make fraudulent instructions appear genuine.In one case in Pune, a device of an accountant for a poultry products company in Ravet was compromised before fraudsters impersonated the company’s CEO and coerced him to transfer Rs 70 lakh to mule accounts. The Pimpri Chinchwad Cyber Crime police have registered an FIR on the complaint of the company’s CEO. In another case, an automobile dealer company was duped of Rs 2.2 crore after the device of its accounts executive was hacked and fraudsters duped the firm by posing as the company’s CEO.According to investigators, the attack typically begins when a target opens a malicious file or link by accident. This allows cybercriminals to gain access to an active WhatsApp Web session linked to the victim’s computers. Once inside, they can view existing conversations, identify key financial decision-makers and manipulate contact information stored on the device.“We have seen instances where fraudsters hack WhatsApp Web sessions and then alter the victim’s contact list. They save the genuine number of the CEO under a different name and block it and then replace it with a fraudulent number carrying the CEO’s name and display picture,” A cyber investigator from Pimpri Chinchwad police said. “As a result, messages from the fraudsters appear to come from a trusted contact already saved in the phone.” he added.The fraud involving the Ravet firm took place in April when the accountant received a WhatsApp message from a number displaying the CEO’s name and photograph. The message referred to an earlier communication and appeared within an existing conversation thread, making it look like a legitimate instruction from the company head. The accountant was directed to transfer Rs 70 lakh to a specified bank account and complied. A short while later, the same sender asked him to transfer another Rs 30 lakh to a different account. This time, the accountant became suspicious and contacted the CEO directly, revealing the company had been defrauded.Investigators said the sophistication of the attack lay not only in impersonating the CEO but in taking over an existing communication channel. “In conventional whale-phishing cases, fraudsters usually contact the victim from an unknown number using the CEO’s photograph and name. But in this highly invasive format, access to the accountant’s existing chats lets fraudsters continue the conversation within the same thread, mimicking earlier communication patterns and context,” A cyber investigator from Pune said. “This significantly enhanced the credibility of the request and reduced the chances of the victim detecting the fraud.”“The technique exploits trust built over months or years of legitimate communication. By studying previous exchanges, fraudsters can replicate language, tone and working patterns of senior executives. The fraudulent requests are often marked as urgent or confidential and are accompanied by instructions not to discuss them with others.” said Rohidas Pawar, Deputy Commissioner of Police (Crime) for Pimpri Chinchwad.Story continues below this adWhale phishing, also known as spear phishing scam or a CEO scam or boss scam, is a highly targeted cyber fraud in which criminals impersonate senior executives or other influential individuals to manipulate employees handling financial transactions. Pune City and Pimpri Chinchwad police have registered more than two dozen such cases since 2022. In the last two months at least six cases have the modus operandi in which device hacking modus operandi has been used.Cyber police advise companies to treat payment instructions received through messaging applications with caution. Every request involving large fund transfers or changes in beneficiary accounts should be independently verified through a phone call to a known and previously verified number. Organisations should regularly review active WhatsApp Web sessions, enable multi-factor authentication, restrict installation of unverified software and conduct periodic cyber-security audits. Finance teams should also adopt dual-approval mechanisms for high-value transactions and undergo regular awareness training to recognise signs of phishing and account compromise, officials said.Sushant Kulkarni is a Special Correspondent with The Indian Express in Pune with 12+ years of experience covering issues related to Crime, Defence, Internal Security and Courts. He has been associated with the Indian Express since July 2010. Sushant has extensively reported on law and order issues of Pune and surrounding area, Cyber crime, narcotics trade and terrorism. His coverage in the Defence beat includes operational aspects of the three services, the defence research and development and issues related to key defence establishments. He has covered several sensitive cases in the courts at Pune. Sushant is an avid photographer, plays harmonica and loves cooking. ... Read MoreClick here to join Express Pune WhatsApp channel and get a curated list of our stories