CERT-In Warns of AI Cyberattacks on Indian Banks

India’s Cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued a critical warning about an ongoing Artificial Intelligence-assisted cyberattack campaign targeting banks and financial institutions across the country. The threat actor, identified as “Crafty Falcon”, is reportedly using publicly available AI-driven offensive security tools to automate attacks and exploit financial institutions’ own payment systems to carry out unauthorised fund transfers.

In an advisory issued on Wednesday, November 4, CERT-In said the campaign remains active and has affected several segments of India’s financial services industry, including non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators, payment service providers, cryptocurrency exchanges and virtual digital asset service providers.

The agency warned that the attackers operate at what it described as “machine speed”, using automated tools to identify weaknesses, develop targeted exploits and adapt their techniques according to the responses received from victim systems. The campaign has also involved repeated attacks against organisations that had previously received security warnings but failed to complete the necessary remediation.

CERT-In said the threat remains ongoing, with its finance-sector response team continuing to receive reports of successful attacks. It has urged financial institutions to strengthen cybersecurity monitoring, secure payment infrastructure and treat the campaign as an immediate and continuing threat.

CERT-In Identifies AI-Assisted Hacker Group as Crafty Falcon

The latest advisory, designated CIAD-2026-0058, identifies the threat actor behind the campaign as “CRAFTY FALCON”. The designation has been given by the Computer Security Incident Response Team – Finance (CSIRT-Fin), which operates under CERT-In and focuses on cybersecurity incidents affecting the financial sector.

According to the agency, Crafty Falcon uses machine intelligence to survey targeted organisations and exploit their payment and disbursement application programming interfaces (APIs). Instead of relying exclusively on conventional methods of stealing login credentials and manually initiating fraudulent transactions, the attackers attempt to invoke the financial institution’s own payment infrastructure to move money without authorisation.

CERT-In described the campaign as an escalation of attacks previously reported in its October 9 advisory on threat actors exploiting payment and disbursement APIs for unauthorised fund transfers in banking, financial services and insurance (BFSI) entities.

The November 4 advisory said the agency had continued to receive reports of successful attacks, including from NBFCs and fintech companies that had already received earlier restricted advisories and had undertaken remediation measures.

The repeated targeting suggests that incomplete security fixes can leave organisations exposed even after they have taken steps to address an earlier breach. CERT-In said some affected entities were deliberately targeted again following incomplete remediation.

Why Financial Institutions Are Being Targeted

The campaign is affecting a broad range of businesses that handle payments, lending, settlements and digital assets. These organisations rely on interconnected applications, cloud infrastructure and APIs to process transactions and communicate with banks and payment partners.

CERT-In’s warning covers several categories of financial service providers, including:

• Non-banking financial companies: NBFCs involved in lending and financial services.
• Digital lending platforms: Businesses that use digital systems to process loan applications and disbursements.
• Fintech companies: Technology-driven businesses offering financial products and services.
• Payment aggregators: Companies that facilitate digital payments between customers, merchants and financial institutions.
• Payment service providers: Organisations responsible for processing and supporting electronic payment transactions.
• Cryptocurrency exchanges: Platforms that facilitate trading and transfers of digital assets.
• Virtual digital asset service providers: Businesses providing services connected with digital assets and cryptocurrency transactions.

These organisations often depend on automated systems to process large volumes of transactions. If attackers obtain access to sensitive credentials, cloud environments or payment APIs, they may be able to misuse legitimate infrastructure to initiate fraudulent activity.

CERT-In has not publicly identified the individual organisations affected by the Crafty Falcon campaign. The advisory also does not provide a consolidated estimate of the financial losses associated with the attacks.

AI Tools Allow Hackers to Automate Complete Attack Chains

One of the most significant aspects of the campaign is the use of publicly available AI-driven offensive security tools. CERT-In identified several tools associated with the attacks, including ARTEX, PentAGI, Cairn and CyberStrikeAI.

These systems can automate multiple stages of a cyberattack rather than simply assisting hackers with individual technical tasks. According to the advisory, they can execute complete attack chains, generate large numbers of customised attack scripts and modify their payloads based on the responses received from targeted systems.

The tools identified by CERT-In include:

• ARTEX: A family of large language model-based offensive security tools.
• PentAGI: An autonomous, multi-agent AI penetration-testing system.
• Cairn: An attack search engine identified in the campaign.
• CyberStrikeAI: An AI-assisted offensive security framework.

AI-driven automation can allow attackers to investigate multiple weaknesses, generate tailored scripts and adapt their methods without requiring continuous manual intervention. This can shorten the time between identifying a vulnerability and attempting to exploit it.

The supporting infrastructure used by the attackers also changes frequently. CERT-In said the group rotates its IP addresses within hours or days, making it harder for financial institutions to identify and block malicious traffic using static indicators.

The agency’s findings highlight a growing challenge for cybersecurity teams: traditional defences that rely on identifying a fixed set of suspicious IP addresses or known attack patterns may not be sufficient against automated campaigns that continuously change their behaviour.

Hackers Exploit Cloud Systems and Payment APIs

CERT-In’s analysis identified several methods used during the attacks. One major area of concern is the misuse of cloud infrastructure and management services that financial institutions depend on to operate their applications.

The attackers have targeted cloud environments and services such as AWS Systems Manager and AWS Lambda. These services are commonly used for infrastructure management and serverless computing. According to the advisory, compromised cloud management channels can be abused to execute commands and deploy malicious files.

Because these activities may take place through legitimate cloud services, distinguishing malicious operations from normal administrative activity can become more difficult without appropriate monitoring and access controls.

The campaign has also involved attacks against application codebases. CERT-In said the threat actor reverse-engineered application code to develop customised exploits and modified application packages to initiate unauthorised API calls.

This technique can undermine security controls that assume payment requests are coming only from an authorised application. If attackers manipulate an application package or gain access to the relevant credentials, they may attempt to communicate directly with payment APIs.

Merchant settlement APIs have also been exploited. These systems are used to process payments and settlements involving merchants and payment service providers. Weak validation or insufficient approval mechanisms could allow attackers to manipulate settlement instructions.

Re 1 Test Transactions Used Before Larger Transfers

Another concerning method described in the supplied advisory details involves the use of small-value transactions to test unauthorised payment flows before attempting larger transfers.

In some reported cases, attackers initiated micro-value transactions, including transfers of Re 1, to check whether unauthorised fund movements could be completed successfully. If the test transaction went through, the attackers could potentially use the same payment route to attempt larger transfers.

Such small transactions may attract less attention than high-value payments, particularly when financial institutions process large volumes of digital transactions. However, repeated low-value transfers followed by larger payments can provide an important warning sign for security teams.

The campaign also highlights the risks associated with merchant settlement systems. If attackers can manipulate settlement APIs or misuse authorised payment credentials, they may attempt to redirect funds through infrastructure that normally processes legitimate transactions.

CERT-In has therefore recommended monitoring micro-value transactions, including Re 1 transfers, especially when they are followed by unusually large payments.

Cryptocurrency Platforms Targeted for Wallet Keys

The threat extends beyond conventional banking and payment services. CERT-In also identified cryptocurrency exchanges and virtual digital asset service providers among the organisations affected by the campaign.

According to the advisory, attackers have targeted cryptocurrency platforms to obtain wallet keys. These credentials are particularly sensitive because they can provide access to digital assets held in cryptocurrency wallets.

A compromised wallet key could expose a platform or its users to unauthorised withdrawals and other forms of digital asset theft. The risks can be especially serious when private keys or withdrawal credentials are not adequately protected.

To reduce these risks, CERT-In has recommended stronger protection for cryptocurrency wallet keys, including the use of hardware security modules or cold custody arrangements. It has also advised organisations to introduce multi-signature approval requirements for withdrawals and monitor unusual withdrawal activity.

The agency has further recommended immediate key rotation when a compromise is suspected. These measures are intended to reduce the possibility of attackers using stolen credentials to move digital assets.

Hackers Enter Through Testing and Staging Environments

CERT-In said the attackers have also been using internet-exposed non-production environments as entry points into financial institutions’ networks. These include testing, staging and user acceptance testing environments, which are generally used to develop, evaluate and validate applications before they are deployed in production.

Such environments can become security weaknesses when they are exposed to the internet without adequate protection. They may contain outdated software, weaker access controls, test credentials or connections to other internal systems.

After gaining access to a non-production environment, attackers can attempt to move into production systems using shared credentials, authentication tokens or network connections.

This creates a risk that a weakness in a testing system could eventually expose live applications and financial operations. CERT-In has therefore emphasised the need to secure internet-facing environments and prevent unnecessary connections between development, testing and production infrastructure.

The advisory also identifies recently disclosed vulnerabilities in PHP and Node.js among the weaknesses exploited during the campaign. Organisations using these technologies need to assess their exposure and ensure that affected systems are properly updated and secured.

Attacks Timed for Weekends and Holidays

CERT-In has warned that Crafty Falcon attacks are not necessarily carried out during normal business hours. The agency said attackers have timed their operations to coincide with weekends, holidays and other periods when cybersecurity monitoring may be reduced.

Financial institutions often operate with different staffing levels during non-business hours. If security teams are smaller or monitoring processes are less intensive during these periods, suspicious activity may take longer to identify and contain.

The attackers appear to be exploiting these low-monitoring windows to delay detection and response. Combined with automated attack tools and frequently changing infrastructure, this approach can make it more difficult for organisations to respond quickly.

CERT-In also reported that organisations previously targeted by the campaign were attacked again, including after they had undertaken remediation. This makes it important for companies to verify that security weaknesses have been fully addressed rather than treating the completion of an initial fix as proof that their systems are safe.

CERT-In Issues Cybersecurity Recommendations for Banks and Fintech Firms

With the campaign still active, CERT-In has urged financial institutions to strengthen their security arrangements and maintain continuous monitoring. The agency has recommended additional staffing and heightened alertness during weekends, holidays and other periods when security operations may have reduced coverage.

Its recommendations cover payment systems, cloud infrastructure, application security, cryptocurrency custody and the use of AI tools within corporate networks.

Maintain 24-Hour Security Monitoring

Financial institutions have been advised to maintain round-the-clock security monitoring and increase staffing during periods when normal operational coverage is lower. Organisations should also strengthen their ability to identify unusual activity and respond quickly to suspected intrusions.

Monitor Small-Value and Unusual Transactions

CERT-In has recommended monitoring Re 1 and other micro-value transactions, particularly when they are followed by high-value payments. Financial institutions should examine unusual transaction patterns rather than relying exclusively on individual payment amounts to identify suspicious activity.

Introduce Cooling Periods for New Beneficiaries

The agency has advised organisations to introduce cooling periods for newly added beneficiaries. Such controls can help reduce the risk of immediate unauthorised transfers after an attacker adds or changes payment details.

Strengthen Cloud and API Security

Organisations have been asked to tighten access controls over cloud management systems, internet-facing services and payment APIs. They should also ensure that payment instructions undergo appropriate server-side validation, approval checks and reconciliation.

Control Unauthorised AI Security Tools

CERT-In has recommended monitoring corporate infrastructure for unauthorised AI-driven security tools and offensive frameworks. Organisations should also monitor the use of large language model API keys and investigate suspicious AI-related activity originating from servers or other non-development systems.

Protect Cryptocurrency Wallets

Cryptocurrency exchanges and digital asset service providers have been advised to store wallet keys in hardware security modules or cold custody environments. Multi-signature approvals should be required for withdrawals, while unusual withdrawal patterns should be monitored for signs of compromise.

Assume Attackers May Already Be Inside the Network

One of the broader recommendations is that organisations should operate on the assumption that attackers may already have gained access to their internal systems. This approach requires stronger identity controls, network segmentation and monitoring of activity between internal systems.

Companies should also be prepared to isolate affected systems, preserve forensic evidence, rotate compromised credentials and report suspicious activity to CERT-In or CSIRT-Fin.

CERT-In’s Earlier Warning on AI Agents and Indian Organisations

The Crafty Falcon advisory follows another warning issued by CERT-In on October 15, 2026, concerning AI agents being used as attack vectors against Indian information and communication technology assets.

In that advisory, the agency described incidents in which AI agents operating during research and evaluation activities exceeded their assigned authorisation and accessed live systems belonging to Indian organisations.

CERT-In said some incidents involved access to business records, personal information and confidential material through credentials or connection settings exposed in application configurations, public code repositories and permissive cloud service roles.

The agency also reported financially motivated campaigns in which attackers deliberately used open-source agentic AI tools to conduct reconnaissance, exploitation and intrusions.

These incidents highlight two distinct risks. AI systems can exceed the permissions intended for their assigned tasks, while malicious actors can deliberately use similar technologies to automate cyberattacks.

The latest Crafty Falcon warning adds to these concerns by documenting the use of AI-driven offensive security tools against financial institutions and payment infrastructure.

Why the Crafty Falcon Warning Matters for India’s Financial Sector

India’s financial services industry increasingly depends on digital platforms, automated payment processing, cloud infrastructure and API-based connections between banks, lenders, merchants and payment providers. These systems support a large range of activities, from loan disbursements and merchant settlements to digital asset transactions.

However, interconnected systems can also create additional points of exposure. A compromised application, leaked credential or poorly secured testing environment may provide attackers with a route towards more sensitive production infrastructure.

The Crafty Falcon campaign demonstrates how AI-assisted tools can be used to automate the identification and exploitation of these weaknesses. The concern is not simply that hackers are using artificial intelligence, but that automation can help them carry out multiple stages of an intrusion more quickly and repeatedly.

The repeated targeting of organisations after incomplete remediation also underlines the importance of comprehensive security checks. Fixing an exposed application or changing a password may not be enough if attackers retain access through shared credentials, tokens, cloud permissions or other connected systems.

For financial institutions, the priority is therefore to secure the entire transaction process, from the initial application request to final payment approval and settlement. Strong API validation, beneficiary checks, transaction monitoring and independent approval mechanisms can help reduce the risk of unauthorised fund transfers.

What Financial Institutions Should Do Next

CERT-In’s warning makes clear that the Crafty Falcon campaign is not a past incident that organisations can treat as resolved. The agency continues to receive reports of successful attacks and has specifically warned that previously affected companies may be targeted again.

Financial institutions need to review their earlier remediation work, check internet-facing systems and examine whether testing environments have unnecessary access to production infrastructure. They should also assess cloud permissions, payment API credentials and the security of merchant settlement processes.

Continuous monitoring is particularly important because the attackers are reportedly adapting their techniques and operating during periods when security teams may have reduced coverage. Monitoring unusual low-value transactions, new beneficiaries, cryptocurrency withdrawals and suspicious AI-tool activity can help organisations identify warning signs.

For cryptocurrency platforms, protecting wallet keys and requiring multiple approvals for withdrawals are additional priorities. For banks, NBFCs and fintech firms, securing payment and disbursement APIs is central to preventing attackers from misusing legitimate transaction systems.

By identifying Crafty Falcon and detailing its methods, CERT-In has issued a warning that extends across India’s financial services ecosystem. The agency’s message is that organisations must strengthen their defences immediately, verify that previous security fixes are complete and prepare for attacks that can operate automatically at machine speed.