Sebi has cautioned regulated entities and listed companies about the "boss scam", following an alert from the Indian Cyber Crime Coordination Centre (I4C).When the chief financial officer (CFO) of an Italian engineering company in Pune received a message from its chief executive officer (CEO) on Microsoft Teams, her immediate response was to do as asked—transfer Rs 56 lakh to two accounts. But when the second direction came the next morning—to urgently transfer Rs 1.5 crore—things did not feel right for her. A timely check then limited the financial loss to Rs 56 lakh.The Italy-headquartered firm was targeted in a whale phishing attack—or what the Securities and Exchange Board of India (Sebi) calls the “boss scam”. The Pimpri-Chinchwad police have launched an investigation.As per the FIR registered at the cybercrime police station, the 49-year-old CFO was working from home on the morning of July 13 when she received a message from a profile carrying the name and photo of the firm’s Italian CEO. The message said the CEO was busy with a government project and that Rs 56 lakh needed to be transferred to two accounts. She grew suspicious and checked with her boss only when the second message came—to transfer Rs 1.5 crore. She approached the police after a phone call to the CEO made her realise that she had been defrauded.What are whale phishing attacks?Whale phishing attacks—also referred to as spear-phishing attacks or CEO scams—are carefully planned cyber frauds that target specific individuals within companies and corporate organisations. They primarily target senior executives responsible for handling financial transactions. The term “whale phishing” reflects the deliberate targeting of high-ranking officials. Since 2022, the Pune city and Pimpri Chinchwad police have together registered more than two dozen cases of such attacks.Also Read | Fake message from CEO Adar Poonawalla’s number, Serum Institute duped of Rs 1 croreOne of the earliest such cases involved Pune-based vaccine manufacturer Serum Institute of India, which was defrauded of Rs 1 crore in 2022. In another incident, a Pune real estate company lost Rs 4 crore in a whale phishing scam in January 2024. Last year, cybercriminals also attempted to target the Centre for Materials for Electronics Technology (C-MET), a premier research institution under the Union Ministry of Electronics and Information Technology. Posing as the organisation’s director-general, they emailed more than two dozen scientists to trick them into transferring money.More recently, in January this year, a major whale phishing attack targeted a Pune real estate firm. Fraudsters impersonated one of the firm’s partners and manipulated a senior executive into transferring Rs 1.95 crore over two days into mule bank accounts.Sebi, the stock market regulator, cautioned regulated entities and listed companies on Friday about these frauds, referring to them as “boss scam” or CEO/MD impersonation fraud, following an alert from the Indian Cyber Crime Coordination Centre (I4C).Story continues below this adAccording to Sebi, fraudsters target CEOs, managing directors, and other senior executives by impersonating them through email, WhatsApp, Microsoft Teams, and social media platforms. They communicate with finance officers or other subordinates, directing them to transfer funds to specified mule bank accounts.Deepfakes and malicious downloadsI4C has identified two emerging tactics. In the first, cybercriminals use deepfake technologies, including voice cloning, AI-generated video calls, and fake social media groups impersonating CEOs or MDs. Finance officers are instructed to transfer funds, often under the pretext that the transaction involves unpublished price-sensitive information (UPSI) and must remain confidential. UPSI can be any non-public information that could materially affect the price of a company’s shares or bonds if it became public.In the second, fraudsters send a compressed .zip archive containing a malicious .exe file and a dynamic link library (.dll). Once opened, it deploys a Trojan dropper that hijacks active WhatsApp Web session tokens, giving attackers access to the victim’s WhatsApp account. In some cases, they secretly alter the device’s contact list by saving their own number under the CEO’s or MD’s name before issuing fraudulent payment instructions to finance personnel.Sushant Kulkarni is a Special Correspondent with The Indian Express in Pune with 12+ years of experience covering issues related to Crime, Defence, Internal Security and Courts. He has been associated with the Indian Express since July 2010. Sushant has extensively reported on law and order issues of Pune and surrounding area, Cyber crime, narcotics trade and terrorism. His coverage in the Defence beat includes operational aspects of the three services, the defence research and development and issues related to key defence establishments. He has covered several sensitive cases in the courts at Pune. Sushant is an avid photographer, plays harmonica and loves cooking. ... Read MoreClick here to join Express Pune WhatsApp channel and get a curated list of our stories