India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued a critical-severity warning about an escalating AI-assisted cyberattack campaign targeting financial institutions, fintech companies and digital payment infrastructure.
In its advisory dated November 4, 2026, CERT-In identified the campaign as “Crafty Falcon” and described it as an AI-assisted financial threat actor capable of surveying targets with machine intelligence and executing attacks at high speed.
Editorial Insight
Key Highlights
Important points readers should notice.
Issue/Event: CERT-In identifies an escalating AI-assisted cyberattack campaign targeting financial institutions.
Location: India.
Authority/Organisation: Indian Computer Emergency Response Team (CERT-In) and its financial-sector response team, CSIRT-Fin.
Action Taken: Critical-severity advisory issued with recommendations for continuous monitoring, API security and stronger transaction controls.
- Impact: Financial institutions face increased cybersecurity risks, including potential unauthorised fund transfers and compromise of digital payment infrastructure.
The advisory updates an earlier warning issued on October 9 concerning the exploitation of payment and disbursement application programming interfaces (APIs) to carry out unauthorised fund transfers.
Financial institutions among the targets
According to CERT-In, incidents have been reported across several parts of the banking, financial services and insurance ecosystem, including:
Editorial Analysis
Why This Matters
Digital payment security: Payment APIs and automated disbursement systems are essential to India's digital financial ecosystem. Consumer protection: Cyberattacks against financial institutions can expose customers to financial loss and data risks. AI-enabled threats: Automated tools can increase the speed and scale of cyberattacks. Fintech ecosystem: NBFCs, payment aggregators and digital lenders need stronger security across connected systems. Business continuity: Repeat attacks can disrupt operations even after organisations have attempted to fix vulnerabilities.
- Non-banking financial companies (NBFCs)
- Digital lending platforms
- Fintech companies
- Payment aggregators
- Payment service providers
- Cryptocurrency exchanges and virtual digital asset service providers
The agency said the campaign had escalated and remained active. It also reported that some organisations which had previously received security warnings and attempted corrective measures were targeted again after incomplete remediation.
AI tools used to automate attacks
CERT-In identified several publicly available AI-driven offensive security tools associated with the campaign. These include the ARTEX family of large-language-model-based tools, PentAGI, Cairn and the CyberStrikeAI framework.
The agency said these tools can automate attack sequences, generate and refine large numbers of customised scripts and adapt their activity based on responses from targeted systems.
The use of these tools can increase the speed and scale of cyber operations. However, the availability of such tools does not by itself establish who operates them or whether a government is involved.
How the attacks reportedly work
CERT-In's technical analysis describes several methods used against financial-sector systems.
Attackers have reportedly exploited exposed cloud infrastructure and inadequately secured testing environments to gain an initial foothold. They may then move towards production systems by exploiting shared credentials, access tokens or network connections.
The advisory also describes attempts to abuse payment and disbursement APIs, merchant settlement systems and weaknesses in application security.
One particularly important warning concerns very small test transactions. Attackers may initiate a transaction as small as ₹1 to check whether an unauthorised payment route works before attempting larger transfers.
The agency also reported that attackers may use shared third-party network infrastructure to bypass IP-based access restrictions and exploit newly disclosed software vulnerabilities.
Repeat attacks and low-monitoring periods
CERT-In warned that some attacks have been timed around weekends, holidays and other periods when security monitoring may be reduced.
The agency also highlighted cases in which organisations were targeted again after incomplete security fixes. This means that simply patching an identified vulnerability may not be enough if attackers have already established persistence or retained access through compromised credentials.
What CERT-In has advised financial companies
The agency has urged financial institutions to treat the campaign as an immediate and continuing threat. Its recommendations include round-the-clock security monitoring, stronger cloud access controls, transaction-velocity monitoring and improved protection of payment APIs.
Financial firms have also been advised to flag unusual small-value transactions, introduce cooling periods for new beneficiaries, apply limits to transfers and strengthen approval procedures for merchant settlements.
CERT-In has further recommended forensic verification after incidents, credential rotation, identity-based access controls and stronger monitoring of AI-tool usage within corporate infrastructure.
Why the warning matters for India
India's financial ecosystem increasingly depends on interconnected digital platforms, instant payment systems, lending applications and APIs that link banks with fintech companies.
A compromise in one part of this ecosystem can create risks for connected institutions and payment operations. The warning therefore extends beyond conventional bank cybersecurity to the wider digital-finance infrastructure.
CERT-In has not publicly named all affected organisations or disclosed a consolidated financial loss figure attributable to the Crafty Falcon campaign. It has also not established that the campaign is state-sponsored or publicly identified the attackers' geographical location.
The advisory underlines the need for financial institutions to strengthen their defences against automated cyber threats as AI tools become more accessible.
