CERT-In Warns of AI-Driven Crafty Falcon Attacks on Indian Financial Firms

Key facts

• On November 4, 2026, the Indian Computer Emergency Response Team (CERT-In) issued a critical advisory on the active Crafty Falcon cyberattack campaign targeting Indian financial entities, calling the threat active and ongoing.
• The AI-assisted campaign seeks unauthorised fund transfers by invoking victims' own payment and disbursement Application Programming Interfaces (APIs).
• The campaign targets non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators, payment service providers, banks and cryptocurrency exchanges.
• Attackers use publicly available AI tools — ARTEX, PentAGI, Cairn and CyberStrikeAI — to automate break-ins at machine speed; security researchers have linked at least two of these tools to China, and China-made ARTEX was used in attacks on South Korean banks since late September and in an espionage campaign against over 200 organisations in at least 14 countries.
• Attack methods include exploiting internet-facing testing environments, targeting cloud infrastructure and reverse-engineering application code, with operations timed for holidays, weekends and other periods of reduced security monitoring to delay detection.
• CERT-In's Computer Security Incident Response Team-Finance (CSIRT-Fin) continues to receive reports of successful attacks, including from entities that had undertaken incomplete remediation after earlier alerts.
• CERT-In and the Indian Cyber Crime Coordination Centre (I4C) have urged financial institutions to maintain round-the-clock monitoring, increase security staffing and lower alert thresholds during low-monitoring periods.
• For exam purposes: CERT-In was established under Section 70B of the Information Technology Act, 2000; an API exposes selected functions while concealing internal workings; and Cyber Swachhta Kendra detects compromised systems and notifies users for cleanup.
• Related recent incidents reported but not officially attributed by CERT-In include the loss of about $2 million by two Mumbai-based non-bank lenders through over 700 unauthorised instant transfers from ICICI Bank accounts on October 8-9, a dark-web leak of 3,897 customer records at State Bank of India, unauthorised debits reported by Spandana Sphoorty Financial on November 1, and a potential customer-data leak under probe at AU Small Finance Bank.