CERT-In Warns of AI-Powered Cyberattacks Targeting Indian Fintech Firms

India’s cybersecurity agency CERT-In has warned of an escalating AI-driven cyberattack campaign targeting financial technology companies and other organisations in the banking, financial services and insurance (BFSI) sector. In an advisory issued on November 4, the agency identified the threat actor as ‘Crafty Falcon’ and described the threat as active and ongoing. According to its financial-sector incident response team, the attackers are using publicly available AI-powered security tools to identify targets, exploit vulnerabilities and misuse payment and disbursement APIs at machine speed. Non-banking financial companies (NBFCs), digital lending platforms, payment aggregators and cryptocurrency exchanges are among the affected entities. CERT-In said some organisations that had previously addressed security vulnerabilities were deliberately targeted again because their remediation efforts were incomplete. The attackers also appear to have taken advantage of the festive period, when reduced monitoring and delayed responses could make suspicious activity harder to detect.

The advisory identified tools such as ARTEX, PentAGI, Cairn and the CyberStrikeAI framework as part of the attackers’ toolkit. The campaign reportedly involved exploiting cloud infrastructure, entering through testing environments and moving into production systems using shared credentials, tokens and network connections. Hackers also reverse-engineered applications, manipulated software packages and made unauthorised API calls to bypass security controls. In some cases, they conducted ₹1 test transactions before attempting larger transfers, misused merchant settlement APIs and targeted cryptocurrency wallets using stolen keys. CERT-In has advised financial institutions to strengthen round-the-clock monitoring, completely remove malicious access and verify systems through forensic checks. It has also recommended isolating testing environments from production systems, restricting cloud access, monitoring high-risk activities, enforcing server-side transaction validation and securing cryptocurrency keys through hardware security modules or cold storage. The agency further stressed that penetration testing must have written approval, a clearly defined scope and an authorised time window.