India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has issued a critical-severity warning about an escalating campaign of artificial intelligence-powered cyberattacks targeting banks, non-banking financial companies (NBFCs), fintech firms and payment service providers.
The November 4, 2026 advisory identifies the threat actor as CRAFTY FALCON. According to CERT-In, attackers are using AI-driven tools to compromise financial institutions and exploit their own payment and fund-disbursement systems to execute unauthorised transactions at machine speed.
The agency said successful attacks were continuing, including against organisations that had already received earlier security warnings and attempted to fix their vulnerabilities.
How Hackers Are Using AI to Steal Money
CERT-In has identified several publicly available AI-driven offensive security tools being used in the campaign. These include the ARTEX family of large language model-based tools, PentAGI, Cairn and the CyberStrikeAI framework.
These tools can automate different stages of a cyberattack, generate customised scripts in rapid succession and modify their techniques based on how target systems respond.
The attackers are exploiting weaknesses in internet-facing applications, cloud infrastructure and automated payment systems. Once inside an organisation’s network, they attempt to access payment APIs and fund-disbursement interfaces to initiate fraudulent transfers.
CERT-In has also identified attempts to compromise cloud services, including AWS Systems Manager and Lambda, to execute commands and deploy malicious files while blending activity with legitimate operations.
Hackers Test Transactions Before Moving Larger Amounts
One particularly concerning technique involves using small-value transactions to check whether an unauthorised fund transfer is possible.
According to CERT-In, attackers have conducted test transactions as small as ₹1 before attempting larger transfers.
Other methods identified in the campaign include:
- Exploiting exposed testing and staging environments to gain access to production systems.
- Using shared credentials and API tokens to move between systems.
- Reverse-engineering applications and modifying software packages to make unauthorised API calls.
- Bypassing IP-based security restrictions through trusted third-party services.
- Exploiting merchant settlement APIs used by payment aggregators.
- Stealing cryptocurrency wallet keys and siphoning digital assets.
The agency has also warned that attackers deliberately target weekends, holidays and periods when security monitoring is reduced. Some compromised organisations have been targeted again after incomplete security remediation.
Which Financial Institutions Are at Risk?
The warning covers a broad range of financial organisations, including NBFCs, digital lending platforms, fintech companies, payment aggregators, payment service providers and cryptocurrency exchanges.
The attacks could result in unauthorised fund transfers, financial losses, compromised cloud infrastructure and theft of sensitive credentials.
CERT-In has also cautioned that attackers may delete records and conceal their activities, making investigations and recovery more difficult.
CERT-In Recommends Stronger Security Measures
Financial institutions have been advised to strengthen round-the-clock monitoring, isolate testing environments from production systems and avoid sharing credentials or API keys.
The agency has recommended identity-based security controls, stronger API authentication, real-time transaction monitoring and additional safeguards for cloud infrastructure.
Banks and payment companies should also flag suspicious patterns, particularly small test transactions to new beneficiaries followed by larger transfers. Cryptocurrency platforms have been advised to secure wallet keys using hardware security modules or cold storage and require multiple approvals for withdrawals.
In case of a suspected breach, organisations should isolate affected systems, preserve forensic evidence, rotate compromised credentials and report incidents to CERT-In or CSIRT-Fin.
The warning highlights how AI is changing the speed and scale of financial cybercrime. With attackers increasingly automating complex operations, banks and fintech companies face growing pressure to strengthen their security systems and detect suspicious activity before fraudulent transfers are completed.