3 weeks ago

I4C Blocks WhatsApp Account Takeover Campaign, Protecting 10,000 Indians

I4C Blocks WhatsApp Account Takeover Campaign, Protecting 10,000 Indians
I4C Blocks WhatsApp Account Takeover Campaign, Protects Over 10,000 Indians From Malware Attack · freepressjournal.in

Bad people on the internet tried to steal WhatsApp accounts from people in India.

They sent fake messages that looked like bank statements or letters from the government.

The messages had a secret file with names like 'Statement of Account.zip' or 'RBI.zip'.

If someone opened the file on a computer, a bad program called a Trojan hid inside and took over their WhatsApp.

The program then used the stolen account to send the same bad file to all the person's friends and groups.

A special group in India called I4C helps stop online crimes, and they found out about the trick.

They blocked the computers that were sending the bad files using a system called the Sahyog Portal.

Because of their work, more than 10,000 people in India were kept safe.

They also sent warnings to more than 58,000 people who might have been tricked.

Experts say people should be careful before opening files that look like bank statements or messages from the tax office.

Key facts

Lead agency
Indian Cyber Crime Coordination Centre (I4C)
Coordinating ministry
Ministry of Home Affairs (MHA)
Citizens protected
More than 10,000 Indians
Potential victims intimated
Over 58,000 via SMS (header 'I4CMHA-G') in last 30 days
Attack vector
Malicious .zip files named 'Statement of Account.zip', 'RBI.zip', 'MCA.zip'
Malware behaviour
Trojan hijacks WhatsApp Web sessions on Windows devices; spreads file to contacts and groups
Countermeasure
Geo-blocking of command-and-control (C2) servers via Sahyog Portal
States affected
Delhi, Gujarat, Maharashtra, Rajasthan

Quotes

Ministry of Home Affairs

Government ministry overseeing internal security

“When the file is extracted and opened on a Windows desktop or laptop, a Trojan is installed which compromises the device and hijacks the victim’s active WhatsApp Web session. In many cases emails are also sent impersonating Income Tax Department.”
freepressjournal.in
“Through these coordinated interventions, more than 10,000 Indians have been protected from this campaign so far. Malwares are being blocked regularly through Sahyog Portal.”
freepressjournal.in

Sources

Related news