AI-powered cyberattacks put Indian fintechs on alert; Shiprocket turns profitable in Q2 FY27

CERT-In warned that CRAFTY FALCON is an active campaign using machine intelligence and AI-assisted tools against India’s financial services sector. The warning covers NBFCs, fintech companies and other financial institutions. CERT-In urged BFSI entities to treat the threat as immediate and continuing.

The campaign has reportedly exploited merchant settlement APIs to move funds. Attackers have also stolen cryptocurrency wallet keys, allowing them to siphon digital assets. The article identifies digital lending platforms, payment aggregators and crypto exchanges among the affected sectors.

The warning matters because financial systems can turn a technical breach into direct monetary loss. Firms need to monitor unusual API activity, protect wallet credentials and review payment flows continuously. CERT-In’s assessment means organisations should not treat the campaign as a closed incident; the threat remains active.

An AI-powered cyberattack is a cyberattack that uses artificial intelligence or machine intelligence to support harmful activity. AI can assist with tasks such as finding targets, producing convincing messages or adapting attack attempts, but the article does not specify which capabilities CRAFTY FALCON used.

CERT-In describes CRAFTY FALCON as a campaign using machine intelligence and AI-assisted tools. Its attacks targeted NBFCs, fintech companies and other financial institutions. The campaign exploited merchant settlement APIs and stole cryptocurrency wallet keys. These actions connected the AI-assisted campaign to direct financial theft.

The key point is that AI adds capability to an existing cyber threat. It does not replace the need to understand the targeted payment or wallet systems. Because CERT-In says the campaign remains active, financial firms must keep watching for suspicious activity and strengthen controls around sensitive systems.

CRAFTY FALCON has a broad target range across India’s financial services ecosystem. CERT-In identified NBFCs, fintech companies and other financial institutions as targets. The campaign is therefore not limited to conventional banks, even though the article’s broader warning refers to BFSI entities.

The reported affected groups include NBFCs, digital lending platforms, payment aggregators, fintech firms and crypto exchanges. This range matters because these businesses handle lending, merchant settlements, payments or digital assets. A campaign can therefore attack different points in the flow of money rather than one institution type.

CERT-In says the threat remains active. That means organisations across this network need to treat the warning seriously, including firms that do not consider themselves banks. Shared payment connections and cryptocurrency services can create broader exposure when attackers move between linked financial systems.

A merchant settlement API is a digital connection used to process or direct money owed to merchants. If attackers exploit it, they may manipulate payment instructions or redirect settlements, causing funds to move to unauthorised destinations. The article reports that CRAFTY FALCON used merchant settlement APIs to move funds.

A cryptocurrency wallet key is a sensitive credential that controls access to digital assets. If attackers obtain such a key, they can potentially authorize transfers from the associated wallet. CERT-In reported that the campaign stole wallet keys and siphoned cryptocurrency assets. The article does not describe the exact theft technique or the specific wallets involved.

Together, these incidents show two financial attack paths: manipulating payment infrastructure and taking control of asset credentials. Since CERT-In says the campaign remains active, firms need close oversight of settlement instructions, API access and wallet-key protection.

Payment systems are valuable because they connect accounts, merchants and financial institutions to actual fund movements. A successful attack can therefore produce immediate financial loss, not merely expose information. Cryptocurrency wallets are similarly attractive because their keys can control digital assets directly. These points make both systems high-impact targets for cybercriminals.

The CRAFTY FALCON campaign illustrates this risk. CERT-In said attackers exploited merchant settlement APIs to move funds and stole wallet keys to siphon cryptocurrency assets. The campaign affected payment aggregators, fintech firms, digital lenders and crypto exchanges, showing how widely these money-handling systems are used.

The article does not rank these targets against others, but their role in transferring or controlling assets explains their appeal. Financial firms must limit access, monitor transfers and protect credentials. The continuing warning means defenders need ongoing checks rather than relying on a single security review.

Fintechs and NBFCs can reduce risk by protecting the systems CRAFTY FALCON reportedly targeted. Useful measures include strong access controls, multi-factor authentication, short-lived credentials, encryption and careful separation of payment functions. Firms should also keep software updated and review permissions regularly.

For APIs, organisations can require authenticated requests, restrict which systems may connect, validate transaction details and apply limits. Payment teams should monitor unusual destinations, amounts, timing and repeated failures. Cryptocurrency keys should be stored securely, preferably with restricted access, transaction approvals and offline protection where appropriate. These recommendations are established cybersecurity practice, not a detailed checklist from the article.

CERT-In reported exploitation of merchant settlement APIs and theft of wallet keys. Because the campaign remains active, monitoring should be continuous. Firms should rehearse incident response, quickly disable compromised credentials and investigate suspicious transfers before losses spread.

A zero-day vulnerability is a security weakness unknown to the organisation or software maker, or one without an available fix. The term reflects the defender having had zero days to prepare a patch. This definition is standard cybersecurity knowledge; the article mentions zero-days only in its trivia question, not as part of CRAFTY FALCON.

Zero-days are dangerous to financial institutions because those organisations operate payment systems, APIs and asset-management tools. If attackers discover a flaw first, they may gain access before normal patching or detection controls are ready. The impact could include stolen funds, disrupted services or exposed customer information, depending on the affected system.

Financial institutions reduce the risk through layered security. They can segment systems, monitor unusual behaviour, limit privileges, maintain backups and apply emergency fixes quickly when vendors issue them. The article’s CERT-In warning reinforces the need for continuous vigilance, although it does not say CRAFTY FALCON used a zero-day.