CERT-In Flags AI-Driven Cyberattacks On Indian BFSI

CERT-In warned Indian banks, fintech companies, NBFCs, insurers, and other financial firms about an escalating AI-driven cyberattack campaign. These attacks target payment and disbursement APIs, which can move money. Attackers use victims’ own systems to initiate unauthorised transfers.

The campaign is linked to CRAFTY FALCON, an AI-assisted financial threat actor. It uses tools such as ARTEX, PentAGI, Cairn, and CyberStrikeAI to find weaknesses and create attack scripts. These tools can run attack steps autonomously. CERT-In reported repeat attacks against organisations that had already tried remediation. Some attacks arrived during holidays or weekends, when monitoring was weaker.

The warning is immediate and ongoing, with successful attacks still reported across financial services. Attack infrastructure can rotate IP addresses within hours or days, making detection harder. CERT-In shared detection rules through restricted advisories and urged every BFSI entity to strengthen monitoring and complete remediation.

A payment or disbursement API is a secure digital doorway that lets software request money movements between accounts. It allows approved systems to send payouts, refunds, or other transfers without manual banking steps. This matters because attackers can abuse that trusted process.

In CERT-In’s November 4, 2026 advisory, CRAFTY FALCON targeted these APIs across banks, NBFCs, and fintechs. If attackers obtain valid access or defeat approval checks, they can submit payment instructions that appear to come from the business. The money may then move without normal human approval.

CERT-In says successful attacks continue across financial services, including organisations that already attempted remediation. CRAFTY FALCON uses AI tools to study responses, refine attack code, and adapt quickly. I4C has also reported cases where malicious AI agents enabled unauthorised transactions worth crores of rupees.

The campaign is persistent and widespread: CERT-In says successful attacks continue across the financial services ecosystem. CRAFTY FALCON also returns to organisations that received earlier warnings and attempted fixes.

For example, previously warned financial entities were deliberately targeted again, including cases with incomplete remediation. The attackers exploit victims’ own payment systems to initiate unauthorised transfers. They also strike during holidays and weekends, when monitoring may be reduced.

Its supporting infrastructure changes rapidly, with internet addresses rotating within hours to days. AI tools generate and refine attack scripts quickly, adapting payloads to each target’s responses. This makes static blocking less reliable and requires continuous monitoring, rapid response, and complete remediation.

AI tools let attackers automate much of a cyberattack instead of handling each step manually. They can scan for promising financial targets, run attacks at machine speed, and create customised scripts repeatedly. Their importance is that they shorten the gap between finding a weakness and attempting an unauthorised transfer.

CERT-In says the CRAFTY FALCON campaign uses ARTEX, PentAGI, Cairn, and CyberStrikeAI. PentAGI is an autonomous, multi-agent penetration-testing system, while the tools together can generate and refine attack scripts rapidly. They adjust payloads according to each target system’s responses, helping attackers exploit payment and disbursement APIs.

These tools can execute complete attack chains autonomously, while supporting infrastructure rotates IP addresses within hours or days. CERT-In reported successful attacks continuing across banks, NBFCs, fintech firms, and other financial services entities. The agency calls the campaign an immediate, continuing threat, including during holidays and weekends when monitoring may be weaker.

Attackers favor weekends and holidays because fewer staff may be watching systems, so suspicious activity can remain unnoticed longer. They also target organisations with incomplete remediation because known weaknesses may still provide an open route into payment or disbursement systems.

CERT-In reported that CRAFTY FALCON deliberately retargeted financial entities that had received earlier restricted advisories and attempted repairs. In some cases, remediation was incomplete; attackers could then use AI tools to adapt scripts quickly and exploit victims’ own APIs for unauthorised transfers.

The campaign’s timing and persistence make a single fix or quiet period unreliable protection. CERT-In said successful attacks continue across banking, NBFC, fintech, and insurance entities, urging immediate, continuing vigilance. Organisations must verify fixes fully, maintain monitoring during low-staff periods, and protect payment APIs against changing attack infrastructure.

Software that can initiate payments needs strong proof of identity, strict permission checks, and constant oversight. These controls help ensure only approved actions occur, detect abuse quickly, and limit losses when attackers exploit an API.

CERT-In says CRAFTY FALCON uses AI to target payment and disbursement APIs and start unauthorised transfers. Its tools can run attack chains autonomously, rapidly rewrite scripts, and adapt payloads to system responses. Strong checks could block unusual recipients, amounts, or permissions. Continuous monitoring could expose attacks timed for weekends or holidays.

This risk is active: CERT-In reported successful attacks across the financial ecosystem and called it immediate and continuing. Earlier remediation did not always stop repeat attacks, especially when fixes were incomplete. Banks, NBFCs, fintechs, and insurers therefore need layered controls, tested fixes, and alerting that remains active outside business hours.