CERT-In warns of Crafty Falcon AI cyberattacks targeting Indian banks, fintech firms and payment APIs. Learn about the risks and security measures.
By News National Editorial Team
New Delhi, November 8, 2026: India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued a critical warning about an escalating artificial intelligence-assisted cyberattack campaign targeting banks, non-banking financial companies (NBFCs), digital lending platforms and fintech businesses.
The campaign, identified as 'Crafty Falcon', involves attackers using AI-powered offensive security tools to identify vulnerabilities, automate cyberattacks and exploit financial institutions' payment and fund-disbursement systems.
In its November 4, 2026 advisory, CERT-In's Computer Security Incident Response Team for Finance (CSIRT-Fin) described the threat as active and ongoing. The agency reported continued successful attacks, including against organisations that had previously received security warnings and attempted to fix their vulnerabilities.
How the Crafty Falcon Cyberattack Works
Unlike conventional attacks that may depend heavily on manual operations, the campaign uses AI-assisted tools to automate multiple stages of an attack.
According to CERT-In, attackers survey financial institutions, identify exposed systems, generate customised scripts and adapt their techniques based on how targeted infrastructure responds.
The attackers reportedly exploit weaknesses in internet-facing applications, cloud infrastructure, testing environments and payment-related application programming interfaces (APIs).
Once access is obtained, they attempt to use the financial institution's own payment and disbursement systems to initiate unauthorised transactions.
This makes the campaign particularly concerning because attackers may exploit legitimate business interfaces rather than relying exclusively on conventional malware.
Four AI-Powered Tools Identified in the Campaign
CERT-In's advisory identifies several publicly available tools associated with the reported attacks:
-
ARTEX: A family of large language model-based offensive security tools.
-
PentAGI: An autonomous multi-agent AI penetration-testing system.
-
Cairn: An attack-search platform.
-
CyberStrikeAI: An AI-assisted cybersecurity and attack framework.
CERT-In reported that these tools can automate attack chains, generate and refine customised scripts and adjust their approaches according to target responses.
The development highlights how publicly accessible AI capabilities can potentially lower the technical barriers for sophisticated cybercriminal operations.
Which Financial Institutions Are at Risk?
The advisory identifies several categories of financial organisations facing exposure, including:
-
Banks and non-banking financial companies.
-
Digital lending platforms.
-
-
-
Payment service providers.
-
Cryptocurrency exchanges.
-
Virtual digital asset service providers.
The threat is particularly relevant to organisations operating automated fund transfers, payment processing systems and cloud-connected financial infrastructure.
CERT-In also warned that some previously affected organisations had been targeted again after incomplete remediation.
Why Payment APIs Have Become a Major Target
Application Programming Interfaces, commonly known as APIs, allow different software applications to communicate and exchange information.
Banks and fintech companies use APIs for services such as:
-
Money transfers and payment processing.
-
-
-
-
Account information and transaction processing.
-
Integration with third-party financial services.
When these interfaces are not properly secured, attackers may attempt to exploit them to initiate unauthorised transactions.
CERT-In's advisory describes attacks involving internet-exposed testing and staging environments, shared credentials, compromised cloud infrastructure and weaknesses in application security.
The agency also identified attempts to exploit payment interfaces using modified application packages and unauthorised API requests.
Attacks During Weekends and Holidays Raise Concerns
Another worrying aspect is the timing of the reported attacks.
CERT-In said attackers had targeted organisations during weekends, holidays and other periods when security monitoring may be reduced.
Such timing can delay the identification of suspicious activities and give attackers additional opportunities to exploit compromised systems.
The agency also reported that some organisations were deliberately targeted again after earlier security weaknesses had not been completely addressed.
This highlights why financial institutions need continuous security monitoring instead of relying only on periodic security checks.
CERT-In's Recommended Cybersecurity Measures
CERT-In has advised financial institutions to strengthen their security arrangements and address weaknesses across applications, APIs and cloud infrastructure.
Important recommended measures include:
1. Strengthen API security
Financial organisations should review payment and fund-disbursement APIs, enforce server-side transaction validation and strengthen authentication mechanisms.
2. Separate testing and production systems
Testing and staging environments should be isolated from live production infrastructure. Credentials and API keys should not be shared between these environments.
3. Improve cloud security
Organisations should monitor cloud audit logs, restrict unnecessary administrative permissions and review the use of cloud management services.
4. Introduce continuous monitoring
Security teams should monitor suspicious activities around the clock, particularly during weekends and holidays.
5. Protect financial transactions
Institutions should detect unusual transaction patterns, including suspicious small-value transfers followed by larger payments.
6. Strengthen application security
Internet-facing applications should receive timely security updates, vulnerability assessments and appropriate security testing.
7. Protect cryptocurrency assets
Cryptocurrency platforms should strengthen wallet-key protection, use appropriate custody controls and introduce additional approval requirements for withdrawals.
8. Improve incident response
Affected organisations should isolate compromised systems, preserve forensic evidence, rotate exposed credentials and follow applicable incident-reporting requirements.
What Does This Mean for Ordinary Bank Customers?
Although CERT-In's latest warning primarily addresses financial institutions, the reported campaign also highlights the importance of digital banking security for customers.
People using mobile banking, UPI, digital lending applications and online payment platforms should follow basic precautions.
-
Never share OTPs, PINs or banking passwords.
-
Avoid installing mobile applications from unknown sources.
-
Do not click suspicious banking links received through messages.
-
Enable transaction notifications.
-
Regularly review bank statements and transaction histories.
-
Contact the bank immediately if an unauthorised transaction is detected.
Customers should remember that legitimate banking institutions do not need their confidential PINs or OTPs to resolve routine account problems.
The agency's warning concerns attacks against financial infrastructure; it does not mean that every bank account or UPI application has been compromised.
India's Financial Sector Faces a New AI Cybersecurity Challenge
Artificial intelligence is creating new opportunities for financial services, but it is also changing the cybersecurity threat landscape.
AI-assisted attacks can increase the speed at which criminals identify weaknesses, generate customised attack methods and interact with exposed digital systems.
For India's expanding digital financial ecosystem, protecting payment infrastructure will require stronger API security, better cloud controls, continuous monitoring and faster vulnerability remediation.
The Crafty Falcon campaign is a reminder that cybersecurity measures must evolve alongside artificial intelligence. Financial institutions cannot depend solely on traditional security controls when attackers are increasingly using automation to conduct sophisticated operations.
CERT-In's latest advisory places the financial sector on alert and reinforces the importance of treating AI-related cybersecurity risks as an ongoing operational priority.
Sources and references
-
-
-
-
-
