Boss Scam Uses DLL Sideloading to Hijack WhatsApp Web and Defraud Enterprises

Gbhackers •Mayura Kathir • June 30, 2026

The new “Boss Scam” is a sharp escalation in CEO fraud: attackers now combine impersonation, Windows DLL sideloading, and WhatsApp Web session theft to turn trusted executive channels into fraud infrastructure. The campaign was highlighted in advisories tied to India’s I4C and NCTAU, which warned that attackers pose as regulators or senior bosses, deliver malicious […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Active Malware Campaign Distributes VBScript via Compromised WhatsApp Accounts In June 2026, a malware campaign was identified that spreads malicious VBScript files through WhatsApp direct messages. The campaign primarily targets users of WhatsApp Desktop and WhatsApp Web, with the highest number of victims in Malaysia. Attackers exploit compromised WhatsApp accounts to send deceptive messages containing attachments that appear as legitimate business documents, such as invoices and payment records. Once executed, the VBScript initiates a multi-stage infection chain that installs Remote Monitoring and Management (RMM) software, granting attackers remote access to the victims' systems. The campaign has affected users across multiple countries, including Brazil, India, Mexico, Singapore, the UK, Spain, Taiwan, Australia, Russia, and Vietnam. The threat actor's method of operation remains under investigation, with evidence suggesting extensive social engineering tactics. The campaign is still active as of the latest reports. 29 sources 70

Extracted Entities

Boss Scam Uses DLL Sideloading to Hijack WhatsApp Web and Defraud Enterprises

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Countries (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)