India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued a critical warning about an escalating artificial intelligence-assisted cyberattack campaign targeting financial institutions, fintech companies and cryptocurrency platforms.
In its November 4, 2026 advisory, CERT-In identified the campaign as 'Crafty Falcon' and described it as an active and ongoing threat. The agency said attackers were using publicly available AI-powered offensive security tools to identify vulnerabilities, develop customised attack scripts and exploit payment and fund-disbursement systems at machine speed.
Editorial Insight
Key Highlights
Important points readers should notice.
Issue/Event: Critical warning over the AI-assisted 'Crafty Falcon' cyberattack campaign.
Location: India.
Authority/Organisation: Indian Computer Emergency Response Team (CERT-In) and CSIRT-Fin.
Action Taken: Issued a critical advisory and recommended stronger monitoring, API security, cloud protection and transaction safeguards.
Impact: Financial institutions face an active cyber threat involving potential unauthorised fund transfers and cryptocurrency wallet theft.
The warning covers a broad range of financial organisations, including non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators, payment service providers and cryptocurrency exchanges.
According to CERT-In's Computer Security Incident Response Team for Finance (CSIRT-Fin), the attackers are exploiting weaknesses in organisations' digital infrastructure and invoking their own payment and disbursement application programming interfaces (APIs) to carry out unauthorised transactions.
The agency identified several AI-driven tools associated with the campaign, including ARTEX, PentAGI, Cairn and the CyberStrikeAI framework. These tools can generate multiple customised scripts, modify their attack methods according to a target's responses and coordinate different stages of an intrusion with limited human intervention.
Editorial Analysis
Why This Matters
India's financial services increasingly depend on digital lending, online payments, automated fund transfers and cloud-based infrastructure. A successful cyberattack against these systems can result in financial losses, disruption of services, exposure of sensitive information and reduced public confidence in digital financial platforms. The Crafty Falcon warning is particularly significant because it describes the use of AI-powered tools to accelerate multiple stages of cyberattacks. Organisations can no longer rely only on traditional security checks or occasional vulnerability assessments. The advisory also highlights the danger of incomplete cybersecurity repairs. Even organisations that have already taken corrective action may remain vulnerable if attackers can exploit unresolved weaknesses.
CERT-In also warned that organisations previously alerted to security weaknesses have been deliberately targeted again. In some cases, attackers reportedly returned after organisations had attempted remediation but left vulnerabilities unresolved.
The campaign has also been timed to exploit periods when security monitoring may be weaker, including weekends, holidays and other low-staffing windows. This can delay the detection of unauthorised access and financial transactions.
The advisory describes several attack techniques. These include exploiting exposed cloud infrastructure, entering through inadequately secured testing environments, misusing credentials and targeting payment APIs. Attackers have also reportedly used small-value test transactions to check whether unauthorised fund transfers are possible before attempting larger transactions.
Cryptocurrency exchanges and virtual digital asset service providers are also among the targeted organisations, with CERT-In warning of attempts to steal wallet keys and move funds from cryptocurrency wallets.
The agency has advised financial institutions to strengthen round-the-clock monitoring, isolate testing systems from production environments, secure payment APIs, improve transaction verification and protect sensitive credentials.
It has also recommended stronger cloud security, rapid vulnerability patching, multi-factor authentication, transaction anomaly detection and additional safeguards for cryptocurrency wallet withdrawals.
CERT-In has asked affected organisations to treat the campaign as an immediate and continuing threat. The advisory does not publicly identify every affected organisation, the total financial losses or the individuals behind the campaign.
The warning highlights how publicly available artificial intelligence tools can be misused to accelerate sophisticated cyberattacks against financial infrastructure. It also places renewed emphasis on the need for banks, fintech companies and digital payment providers to strengthen their security systems.
