On 7 August 2026, the Indian Cyber Crime Coordination Centre (I4C) under the Ministry of Home Affairs cautioned corporates and finance professionals about a "Boss Scam" — self-propagating malware disguised as account statements and regulatory communications, spreading over WhatsApp, SMS and email, that takes over the accounts of senior executives and is then used to order high-value fraudulent transfers. Chartered Accountants, company directors, CFOs and corporate finance teams are the prime targets. For an NDA aspirant, cyber security is now a national-security subject, not merely a technical one.
The news in one frame
The essentials:
- The scam: malware posing as a "Statement of Account", "MCA" or "RBI" file, circulated on WhatsApp, SMS and email.
- The mechanism: it takes over the victim's WhatsApp account, then uses that trusted identity to instruct finance staff to transfer funds to mule accounts.
- The targets: Chartered Accountants, company directors, CFOs and corporate finance teams.
- Spread: identical cases reported from Delhi, Gujarat, Maharashtra and Rajasthan.
- Response: I4C alerted over 58,000 potential victims in 30 days through the SMS header 'I4CMHA-G'; shared threat signals with CERT-In, Microsoft and Indian anti-virus and threat-intelligence firms; and protected more than 10,000 Indians by geo-blocking command-and-control (C2) servers through the Sahyog Portal.
- I4C had issued an earlier advisory on 22 June 2026.
Why this attack works — social engineering
The concept at the heart of it, and the examinable idea:
- Social engineering is manipulating people rather than breaking systems. The attacker does not defeat the bank's encryption; he persuades a human being to move the money voluntarily.
- This scam stacks three psychological levers: 1. Authority — the instruction appears to come from the boss; 2. Trust in the channel — it arrives on WhatsApp, from a real, known account, not a suspicious email address; 3. Urgency — payment demands are framed as immediate, discouraging verification.
- The file names are the bait: "Statement of Account", "MCA", "RBI" are exactly the documents a finance professional expects to receive, so the attachment looks routine.
- Self-propagating means that once an account is compromised, the malware forwards itself to that person's contacts — so the sender is always someone the next victim already trusts.
The defence is procedural, not technical: verify any payment instruction through a second, independent channel — a phone call to a known number. That single habit defeats the entire attack, and it is the answer to give if asked.
This applied material is exactly what the NDA GAT science notes build.
The vocabulary you must know
A reliable set of definitional questions:
| Term | Meaning |
|---|---|
| Phishing | Fraudulent messages, usually email, luring victims into revealing credentials |
| Vishing / Smishing | The same by voice call / by SMS |
| Malware | Umbrella term — virus, worm, trojan, spyware, ransomware |
| Trojan | Malicious code disguised as a legitimate file — exactly this case |
| Worm | Malware that self-propagates without user action |
| Ransomware | Encrypts data and demands payment for the key |
| Mule account | A third party's bank account used to receive and move criminal proceeds |
| C2 server | The attacker's command-and-control machine that directs infected devices |
| Botnet | A network of compromised devices under common control |
| Zero-day | A vulnerability exploited before a patch exists |
| DDoS | Flooding a service with traffic to deny access to legitimate users |
A mule account holder is often a student or unemployed person paid a small commission — and is legally liable, a point worth making to any young audience.
India's cyber-security architecture
The institutional map, frequently mismatched in MCQs:
- I4C — Indian Cyber Crime Coordination Centre, under the MHA. The crime and policing arm. It runs the National Cyber Crime Reporting Portal (NCRP), the helpline 1930 for financial fraud, and the Citizen Financial Cyber Fraud Reporting and Management System, which can freeze a fraudulent transfer if reported quickly enough — hence the "golden hour".
- CERT-In — Indian Computer Emergency Response Team, under MeitY, the national nodal agency for cyber-security incident response, operating under the IT Act, 2000.
- NCIIPC — National Critical Information Infrastructure Protection Centre, under the NTRO, protecting critical sectors: power, banking, telecom, transport, defence and government.
- Defence Cyber Agency — the tri-service military cyber organisation.
- National Cyber Security Coordinator, in the National Security Council Secretariat.
- Law: the Information Technology Act, 2000 (amended 2008) — Section 66 covers computer-related offences, Section 66D cheating by personation, Section 43A data protection obligations; the DPDP Act, 2023 governs personal data; and the Bharatiya Nyaya Sanhita now carries the general fraud provisions.
- Sahyog Portal — the MHA platform for coordinating takedown and blocking requests with intermediaries.
These themes recur in the NDA daily current affairs.
Why it matters
For the essay/interview and bigger picture:
- Cyber fraud is now a mass crime. It reaches more citizens than most conventional offences, and the losses are concentrated on those least able to bear them.
- The military dimension is real. The same techniques — social engineering, account takeover, self-propagating malware — are used in espionage and information operations against defence personnel. Officers are explicitly targeted; personal cyber hygiene is an operational duty, not a private matter.
- Awareness is the cheapest control. No firewall stops an authorised person voluntarily transferring money. Verification habits, not software, are the decisive defence — which is why an advisory of this kind is itself a security measure.
🔑 Revision block
The scam, mechanically. Malware disguised as a "Statement of Account", "MCA" or "RBI" file spreads over WhatsApp, SMS and email → it hijacks a senior executive's WhatsApp → that trusted account instructs finance staff to pay mule accounts. Targets: Chartered Accountants, directors, CFOs and corporate finance teams; cases from Delhi, Gujarat, Maharashtra and Rajasthan.
Why it works. This is social engineering — attacking the person, not the system. Three levers stacked: authority (it is the boss) · trust in the channel (a real WhatsApp account) · urgency (pay now, do not check). Being self-propagating, it always arrives from someone the next victim already trusts.
The response, in numbers. Advisory of 7 August 2026, following an earlier one on 22 June 2026 · over 58,000 potential victims alerted in 30 days through the SMS header 'I4CMHA-G' · more than 10,000 protected by geo-blocking command-and-control (C2) servers through the Sahyog Portal.
Who does what — the standard mismatch. I4C (Indian Cyber Crime Coordination Centre) = Ministry of Home Affairs, the crime-and-policing arm; runs the National Cyber Crime Reporting Portal (NCRP) and helpline 1930 · CERT-In = MeitY, national nodal agency for incident response, under the Information Technology Act, 2000 · NCIIPC = under NTRO, protects critical information infrastructure · Defence Cyber Agency = tri-service.
Vocabulary that gets tested. trojan = disguised malware · worm = self-propagating · ransomware = encrypts and demands payment · mule account = receives criminal proceeds, and its holder is legally liable · C2 = command-and-control server.
The law. IT Act, 2000 (amended 2008) — Section 66, Section 66D cheating by personation, Section 43A data protection · DPDP Act, 2023 for personal data · Bharatiya Nyaya Sanhita for general fraud.
The defence. Verify any payment instruction on a second, independent channel — a call to a known number — and report within the golden hour. For the essay: the weakest link is human, so the strongest control is a habit.
🎯 Practice MCQs
Q1. I4C functions under the Ministry of: (a) Home Affairs (b) Electronics & IT (c) Defence (d) Finance → (a) — the MHA.
Q2. CERT-In functions under the Ministry of: (a) Electronics & IT (b) Home Affairs (c) Defence (d) Communications → (a) — MeitY.
Q3. India's helpline for reporting financial cyber fraud is: (a) 1930 (b) 100 (c) 1098 (d) 112 → (a) — 1930.
Q4. CERT-In derives its mandate from the: (a) IT Act, 2000 (b) DPDP Act, 2023 (c) Telegraph Act, 1885 (d) BNS → (a) — the Information Technology Act, 2000.
Q5. NCIIPC protects: (a) critical information infrastructure (b) household devices (c) social media (d) postal services → (a) — power, banking, telecom, transport, defence.
Q6. Manipulating people rather than systems is called: (a) social engineering (b) reverse engineering (c) hacking hardware (d) encryption → (a) — social engineering.
Q7. Malware disguised as a legitimate file is a: (a) trojan (b) worm (c) firewall (d) patch → (a) — a trojan.
Q8. Malware that spreads by itself without user action is a: (a) worm (b) trojan (c) cookie (d) macro → (a) — a worm; "self-propagating" is the clue.
Q9. A "mule account" is used to: (a) receive and move criminal proceeds (b) pay taxes (c) hold savings (d) trade shares → (a) — laundering the fraud proceeds.
Q10. A "C2 server" refers to: (a) command-and-control (b) cloud computing (c) cyber certification (d) code compiler → (a) — the attacker's control machine.
Q11. Fraud attempted through voice calls is: (a) vishing (b) phishing (c) smishing (d) sniffing → (a) — vishing (SMS is smishing).
Q12. Ransomware typically: (a) encrypts data and demands payment (b) deletes hardware (c) speeds up a PC (d) blocks electricity → (a) — encryption for extortion.
Q13. A "zero-day" vulnerability is one that: (a) is exploited before a patch exists (b) lasts one day (c) affects no one (d) is already fixed → (a) — unknown to the vendor.
Q14. The tri-service military cyber organisation is the: (a) Defence Cyber Agency (b) CERT-In (c) NCIIPC (d) I4C → (a) — the Defence Cyber Agency.
Q15. The most effective defence against this scam is: (a) verifying the instruction on a second channel (b) a stronger password (c) a faster computer (d) deleting WhatsApp → (a) — independent verification.
📋 How this gets asked (PYQ pattern)
Cyber security is a reliable NDA sci-tech set. The reliable framings are body-to-ministry matching (I4C-MHA, CERT-In-MeitY, NCIIPC-NTRO), the 1930 helpline, malware type definitions (trojan, worm, ransomware), and phishing vs vishing vs smishing. A common trap places CERT-In under the Home Ministry or calls a self-propagating program a trojan (it is a worm). The fresh 2026 hook is the I4C Boss Scam advisory — ideal for "which agency / which term / which ministry" items. We reference the pattern, not any exact past question.
Preparing for NDA? Cyber security is now core GAT material and a serious SSB discussion topic — officers are themselves targets of social engineering. Follow our daily NDA current affairs and train with serving-officer faculty in the upcoming Cavalier courses in Delhi.
✍️ Written by Aditya Tiwari — Technology, security & current-affairs faculty at The Cavalier. Reviewed by the Cavalier Faculty Desk. The Cavalier, founded by ex-Army officers, has trained NDA/CDS/SSB aspirants since 2001 (Facebook · YouTube).
Source: PIB / Ministry of Home Affairs (I4C), 7 August 2026. Facts cross-verified with independent sources.