The Indian Computer Emergency Response Team (CERT-In) has issued a critical warning about a surge in AI-powered cyberattacks by a threat actor dubbed 'CRAFTY FALCON', targeting banks, NBFCs, fintechs, and insurers through vulnerable payment and disbursement APIs to initiate unauthorized fund transfers.
- CRAFTY FALCON uses AI to automate unauthorized payment API attacks.
- Repeat attacks exploiting remediation gaps and off-hours detected.
- CERT-In urges BFSI entities to strengthen defenses and update apps.
What happened
CERT-In issued a critical advisory on November 4, 2026, revealing a significant escalation in AI-assisted cyberattacks targeting the banking, financial services and insurance (BFSI) sector in India. The threat actor, identified as CRAFTY FALCON, leverages machine intelligence to detect vulnerabilities and carry out rapid unauthorized transactions by exploiting payment and disbursement APIs.
These attacks have specifically affected banks, NBFCs, fintech companies, and related financial organizations. CERT-In highlighted that some entities facing attacks had previously received restricted warnings and attempted remediation, yet the threat actor has persistently targeted them, sometimes during holidays or weekends to delay detection and response.
Why it matters
The use of sophisticated AI-driven offensive tools such as ARTEX, PentAGI, Cairn, and CyberStrikeAI allows CRAFTY FALCON to autonomously perform entire attack chains, generate customized payloads, and adapt dynamically to defenses. This automation drastically increases the scale, speed, and stealth of financial cyber intrusions, elevating risk across India’s BFSI ecosystem.
Additionally, CERT-In’s findings align with prior warnings in October about agentic AI tools accessing live systems and executing financial fraud. The rise of AI-powered cybercrime necessitates urgent action from BFSI entities to update security frameworks and share threat intelligence. Separate vulnerabilities flagged in Tata Motors’ connected vehicle apps further illustrate the expanding attack surface for Indian organizations.
What to watch next
Indian BFSI organizations must intensify their cybersecurity posture by addressing detected API weaknesses and ensuring complete remediation of previously identified flaws. Monitoring for unusual transactions particularly during off-peak periods will be critical to early detection going forward.
CERT-In and Indian Cyber Crime Coordination Centre (I4C) will likely continue issuing advisories as this AI-driven threat landscape evolves. Industry adoption of AI-powered defense tools and collaboration on threat intelligence sharing will be key to mitigating these rapidly advancing cyberattacks targeting India’s financial sector.