Follow us on Google News
India’s cybersecurity authorities have issued a fresh warning to banks, non-banking financial companies (NBFCs), fintech firms and payment service providers over an ongoing campaign of AI-assisted cyberattacks that can compromise financial systems and transfer money at machine speed.
The Indian Cybercrime Coordination Centre (I4C), operating under the Union Home Ministry, warned financial institutions on November 4, 2026, that criminals were exploiting weaknesses in automated payment systems to carry out unauthorised transactions.
On the same day, the Indian Computer Emergency Response Team (CERT-In) issued a critical-severity advisory identifying the campaign as CRAFTY FALCON.
The advisory says attackers are using AI-enabled offensive tools to identify vulnerabilities, penetrate financial infrastructure and initiate fraudulent transfers through the institutions’ own payment interfaces.
Authorities have also confirmed that some organisations were targeted again after attempting to fix previously identified security weaknesses, indicating that the campaign remains active.
Hackers Exploit Payment Systems To Transfer Money
The attacks primarily target vulnerabilities in internet-facing applications, poorly configured servers and application programming interfaces, commonly known as APIs.
An API is a digital connection that allows two software systems to communicate. Banks and fintech companies use these connections to process payments, approve transactions and transfer funds between accounts.
When criminals obtain access to these systems, they may be able to initiate unauthorised payments without following the normal customer-facing transaction process.
Investigators found that attackers exploited weaknesses in automated fund-disbursement systems and payment APIs to transfer money into mule accounts.
These are bank accounts used by criminals to receive and move illegally obtained funds, often through several institutions to make tracing the money more difficult.
The stolen funds can then be quickly transferred or withdrawn through services such as IMPS and NEFT.
According to the authorities, the attackers may subsequently delete records or conceal their activities to complicate investigations.
CERT-In’s findings show that some hackers first conducted small test transactions, including payments of just ₹1, to determine whether compromised systems could successfully transfer funds.
Once those transactions succeeded, the attackers attempted larger transfers.
This approach allows criminals to test payment infrastructure before attempting substantial financial theft.
AI Tools Allow Attacks To Operate At Machine Speed
The latest advisory identifies the use of several publicly available AI-assisted offensive security tools.
These include the ARTEX family of language-model-based tools, the PentAGI autonomous penetration-testing system, the Cairn attack search engine and the CyberStrikeAI framework.
Such tools are capable of automating parts of cybersecurity testing, including identifying exposed systems, generating computer scripts and attempting different methods of exploiting vulnerabilities.
Although these technologies can have legitimate security-testing uses, authorities say criminals have been deploying them against financial institutions without authorisation.
The tools can rapidly generate and modify attack scripts based on responses from targeted systems.
This allows attackers to test multiple approaches much faster than they could through entirely manual operations.
CERT-In also identified incidents in which criminals used exposed testing environments to reach operational financial systems.
In other cases, attackers abused cloud management tools, exploited newly disclosed software vulnerabilities or modified application packages to make unauthorised payment requests.
Some attacks also involved bypassing controls based on trusted internet addresses.
Instead of relying only on stolen passwords, criminals exploited weaknesses in the underlying infrastructure to make their requests appear legitimate.
The advisory describes the campaign as involving AI-assisted and autonomous tooling. However, it does not establish that every intrusion was conducted entirely without human involvement.
Financial Institutions Hit Again After Security Fixes
One of the most significant findings concerns repeated attacks against institutions that had already received earlier cybersecurity warnings.
CERT-In said some NBFCs and fintech firms were targeted again after incomplete remediation.
The agency also observed attacks timed to coincide with weekends, public holidays and other periods when security monitoring may be reduced.
Such timing can delay detection, allowing criminals more time to exploit compromised systems and move funds.
The warning expands upon an earlier critical advisory issued on October 9, which identified attacks against payment and disbursement APIs used by financial institutions.
The November 4 update indicates that the threat has continued despite previous warnings and defensive measures.
The newly published advisory also identifies cryptocurrency exchanges and other virtual digital asset service providers as potential targets.
Investigators observed attacks involving stolen cryptocurrency wallet keys and unauthorised transfers from digital wallets.
The advisory does not publicly identify every affected institution or disclose the total amount stolen through the CRAFTY FALCON campaign.
It would therefore be inaccurate to assign all recently reported banking cyber fraud losses to this threat actor without further evidence.
Banks Asked To Strengthen Monitoring And Transaction Controls
Authorities have urged financial institutions to strengthen surveillance of critical infrastructure and monitor suspicious payment activity continuously.
The recommended safeguards include setting daily and per-transaction transfer limits, verifying beneficiaries and identifying unusually rapid transactions.
Institutions have also been advised to monitor small test payments followed by larger transfers, a pattern that may indicate attackers checking whether stolen access credentials remain usable.
CERT-In wants organisations to separate testing environments from operational financial systems and avoid sharing sensitive credentials between them.
It has also recommended stronger controls over cloud infrastructure, tighter management of payment APIs and additional verification before funds are released.
Financial firms have been advised to maintain heightened security monitoring during weekends and holidays, when attackers may attempt to exploit reduced staffing.
The warning follows increased scrutiny of financial-sector cybersecurity by the Reserve Bank of India, which has sought information about banks’ compliance with existing security requirements and preparedness for AI-related threats.
The latest advisory demonstrates that the immediate concern is not simply the use of artificial intelligence in cybercrime, but the ability of criminals to exploit existing weaknesses in financial infrastructure at substantially greater speed.
What This Means For You:
Customers should enable transaction alerts and immediately report any unauthorised debit to their bank and the national cybercrime helpline, 1930. Financial institutions must ensure that automated payment systems cannot move funds without appropriate verification and monitoring.
