Prateek Tanmay
4 min readPuneJul 19, 2026 06:20 PM IST
When the chief financial officer (CFO) of an Italian engineering company in Pune received a message from its chief executive officer (CEO) on Microsoft Teams, her immediate response was to do as asked—transfer Rs 56 lakh to two accounts. But when the second direction came the next morning—to urgently transfer Rs 1.5 crore—things did not feel right for her. A timely check then limited the financial loss to Rs 56 lakh.
The Italy-headquartered firm was targeted in a whale phishing attack—or what the Securities and Exchange Board of India (Sebi) calls the “boss scam”. The Pimpri-Chinchwad police have launched an investigation.
As per the FIR registered at the cybercrime police station, the 49-year-old CFO was working from home on the morning of July 13 when she received a message from a profile carrying the name and photo of the firm’s Italian CEO. The message said the CEO was busy with a government project and that Rs 56 lakh needed to be transferred to two accounts. She grew suspicious and checked with her boss only when the second message came—to transfer Rs 1.5 crore. She approached the police after a phone call to the CEO made her realise that she had been defrauded.
What are whale phishing attacks?
Whale phishing attacks—also referred to as spear-phishing attacks or CEO scams—are carefully planned cyber frauds that target specific individuals within companies and corporate organisations. They primarily target senior executives responsible for handling financial transactions. The term “whale phishing” reflects the deliberate targeting of high-ranking officials. Since 2022, the Pune city and Pimpri Chinchwad police have together registered more than two dozen cases of such attacks.
One of the earliest such cases involved Pune-based vaccine manufacturer Serum Institute of India, which was defrauded of Rs 1 crore in 2022. In another incident, a Pune real estate company lost Rs 4 crore in a whale phishing scam in January 2024. Last year, cybercriminals also attempted to target the Centre for Materials for Electronics Technology (C-MET), a premier research institution under the Union Ministry of Electronics and Information Technology. Posing as the organisation’s director-general, they emailed more than two dozen scientists to trick them into transferring money.
More recently, in January this year, a major whale phishing attack targeted a Pune real estate firm. Fraudsters impersonated one of the firm’s partners and manipulated a senior executive into transferring Rs 1.95 crore over two days into mule bank accounts.
Sebi, the stock market regulator, cautioned regulated entities and listed companies on Friday about these frauds, referring to them as “boss scam” or CEO/MD impersonation fraud, following an alert from the Indian Cyber Crime Coordination Centre (I4C).
Story continues below this ad
According to Sebi, fraudsters target CEOs, managing directors, and other senior executives by impersonating them through email, WhatsApp, Microsoft Teams, and social media platforms. They communicate with finance officers or other subordinates, directing them to transfer funds to specified mule bank accounts.
Deepfakes and malicious downloads
I4C has identified two emerging tactics. In the first, cybercriminals use deepfake technologies, including voice cloning, AI-generated video calls, and fake social media groups impersonating CEOs or MDs. Finance officers are instructed to transfer funds, often under the pretext that the transaction involves unpublished price-sensitive information (UPSI) and must remain confidential. UPSI can be any non-public information that could materially affect the price of a company’s shares or bonds if it became public.
In the second, fraudsters send a compressed .zip archive containing a malicious .exe file and a dynamic link library (.dll). Once opened, it deploys a Trojan dropper that hijacks active WhatsApp Web session tokens, giving attackers access to the victim’s WhatsApp account. In some cases, they secretly alter the device’s contact list by saving their own number under the CEO’s or MD’s name before issuing fraudulent payment instructions to finance personnel.
