India's cybersecurity agency has warned banks, non-banking financial companies (NBFCs) and fintech firms about an ongoing campaign of artificial intelligence-powered cyberattacks targeting financial systems. The Indian Computer Emergency Response Team (CERT-In) has identified a threat actor known as Crafty Falcon, which is using publicly available AI tools to automate intrusions and exploit payment infrastructure.
In an advisory issued on November 4, CERT-In said the campaign had affected digital lenders, payment service providers, payment aggregators and cryptocurrency exchanges. The agency warned that some organisations had experienced repeated attacks despite receiving earlier security advisories and implementing corrective measures.
According to CERT-In, the attackers are using AI-assisted tools to identify vulnerabilities, generate attack scripts and execute cyber intrusions at high speed. The agency identified four tools associated with the campaign: ARTEX, PentAGI, Cairn and CyberStrikeAI.
These tools can automate multiple stages of an attack, allowing cybercriminals to adjust their methods based on how targeted systems respond.
Security researchers have linked at least two of the tools to China. However, CERT-In has not identified the individuals or organisations responsible for the campaign or attributed the attacks to any government.
The attackers have reportedly exploited vulnerabilities in payment and fund-disbursement application programming interfaces (APIs), which financial institutions use to process transactions and connect banking applications.
The campaign also involves targeting exposed testing environments, cloud infrastructure and shared credentials to gain access to operational systems.
CERT-In said attackers have timed some intrusions to coincide with weekends, public holidays and periods of reduced security monitoring, potentially delaying detection and response.
The warning follows several reported cybersecurity incidents involving Indian financial institutions.
According to Reuters, two Mumbai-based non-bank lenders suffered approximately $2 million in unauthorised instant transfers during October through accounts linked to ICICI Bank. The incidents reportedly involved compromised payment APIs.
Separately, State Bank of India disclosed a dark-web leak involving 3,897 customer records, while Spandana Sphoorty Financial reported unauthorised bank-account debits. AU Small Finance Bank also said it was investigating a possible customer-data leak.
CERT-In has not established that these incidents were connected to the Crafty Falcon campaign.
The agency has advised financial institutions to strengthen payment API security, monitor suspicious transactions and maintain tighter controls over cloud environments and system access.
Organisations have also been urged to separate testing and production systems, review access permissions and maintain continuous monitoring for unusual activity.
Financial institutions are required to report qualifying cybersecurity incidents to CERT-In within six hours of detection. Banks and NBFCs must also report relevant incidents to the Reserve Bank of India through its DAKSH portal.
The advisory comes as AI-powered automation creates additional cybersecurity challenges for financial institutions, particularly where interconnected payment systems can be exploited to initiate unauthorised transactions.
Disclaimer: This article may include information derived from interviews, press releases, public statements, research, company communications and other publicly available or third-party sources. Such material may be summarised, paraphrased or contextualised for journalistic and editorial purposes. All rights in third-party content remain with their respective owners.