CERT-In Warns of AI-Powered CRAFTY FALCON Cyberattacks in India

CERT-In warns Indian banks and fintech companies about CRAFTY FALCON, an AI-assisted cyberattack campaign exploiting payment APIs.

By News National Editorial Team

India's Financial Institutions Face Growing AI-Driven Cybersecurity Threat

India's financial sector is facing an escalating cybersecurity threat after the Indian Computer Emergency Response Team (CERT-In) issued a critical warning about an AI-assisted cyberattack campaign identified as CRAFTY FALCON. The campaign targets banking and financial services organisations, including non-banking financial companies (NBFCs), fintech businesses, digital lending platforms, payment aggregators and cryptocurrency exchanges.

In its advisory dated November 4, 2026, CERT-In described the threat as active and ongoing. The agency warned that attackers are using publicly available artificial intelligence-powered offensive security tools to automate reconnaissance, develop targeted attack scripts and exploit weaknesses in financial technology infrastructure.

The warning highlights how artificial intelligence is changing the cybersecurity landscape, enabling attackers to conduct sophisticated operations at machine speed.

How the CRAFTY FALCON Campaign Operates

According to CERT-In, the attackers target internet-facing applications, cloud infrastructure, exposed application programming interfaces (APIs) and privileged endpoints.

Payment and disbursement APIs are particularly important because they allow financial institutions to process transactions and transfer funds between systems.

Investigations described in the advisory indicate that attackers have obtained or misused credentials associated with payment gateways, aggregators and partner-bank integrations. They then attempt to invoke payment or disbursement functions directly, bypassing application-level checks.

These checks may normally include customer verification, know-your-customer procedures, beneficiary validation, transaction limits and loan approval workflows.

The agency also reported that attackers have used AI-assisted tools to analyse application codebases and create customised attack scripts.

Artificial Intelligence Tools Used in Attacks

CERT-In identified several publicly available tools associated with the campaign, including ARTEX, PentAGI, Cairn and CyberStrikeAI.

These tools can support automated security testing and offensive operations. In the reported campaign, they were allegedly used to accelerate reconnaissance, generate attack scripts and adapt operations according to target responses.

The development demonstrates that tools originally associated with security research and testing can also create risks when misused by malicious actors.

Why Financial Companies Remain Vulnerable

CERT-In identified several weaknesses that organisations should address.

Internet-accessible testing and staging environments can provide attackers with an entry point. Shared credentials, tokens and network connections between testing and production systems may allow intruders to move into more sensitive infrastructure.

The agency also warned that attackers have deliberately timed some operations to coincide with weekends, holidays and other periods when security monitoring may be reduced.

Importantly, organisations that had previously attempted remediation were reportedly targeted again where fixes were incomplete.

What Banks and Fintech Companies Should Do

Financial institutions should immediately review their API security architecture and transaction monitoring systems.

Recommended measures include:

• Enforce strong authentication and authorisation for every payment API.

• Introduce independent transaction verification and beneficiary validation.

• Apply strict transaction limits and anomaly detection.

• Remove unnecessary internet access to staging and testing environments.

• Separate development, testing and production infrastructure.

• Rotate compromised credentials, API keys and access tokens.

• Maintain continuous security monitoring, including during weekends and holidays.

• Conduct independent security assessments and penetration testing.

• Prepare incident-response procedures for unauthorised transfers.

Organisations should also investigate suspicious API activity and review whether earlier security fixes were implemented completely.

What Customers Should Know

Customers should remain alert to unexpected banking notifications, suspicious payment requests and unusual account activity.

People should never share OTPs, passwords, PINs or banking credentials with unknown callers or websites. Customers who notice unauthorised transactions should immediately contact their bank through official channels and report suspected cybercrime through India's official cybercrime reporting portal.

A New Challenge for India's Digital Economy

India's growing digital financial ecosystem depends on secure payment infrastructure, reliable banking services and customer confidence.

The CRAFTY FALCON warning demonstrates that cybersecurity must extend beyond traditional passwords and antivirus software. Financial institutions need stronger API protection, continuous monitoring, secure cloud environments and faster incident response.

As AI capabilities become more accessible, organisations must prepare for attackers who can automate complex operations and exploit weaknesses more quickly.

The immediate priority is to strengthen financial infrastructure before an attempted intrusion becomes a major financial loss.

Official advisory: CERT-In Advisory CIAD-2026-0058, issued November 4, 2026.

Sources:

1. CERT-In – Official cybersecurity advisory.

2. Reuters – India cybercrime agency warns financial firms of AI-driven cyberattacks.

3. The Indian Express – CERT-In flags CRAFTY FALCON campaign targeting Indian fintech firms.

imagesource: https://www.biocatch.com/blog/the-war-arrived-on-schedule-interpol-confirms-the-rise-of-agentic-ai-powered-fraud