VULNpocalypse
CriticalBreach / campaignActive

CRAFTY FALCON: CERT-In warns AI-driven attacks are draining Indian BFSI through their own payment APIs

CERT-In advisory CIAD-2026-0058 names CRAFTY FALCON, an AI-assisted actor invoking Indian NBFC and fintech payment APIs to move funds at machine speed.

Published
Updated
Exploitation
Yes. CERT-In says CSIRT-Fin keeps receiving reports of successful attacks, with entities re-targeted after incomplete remediation; media reports put losses near 300 crore rupees, a figure CERT-In has not confirmed

What happened

On 4 November 2026 CERT-In’s financial-sector team CSIRT-Fin issued critical advisory CIAD-2026-0058, “Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON” (last updated 5 November). It escalates an earlier critical advisory, CIAD-2026-0046 of 9 October 2026, about attackers exploiting payment and disbursement APIs for unauthorised fund transfers (CERT-In CIAD-2026-0058).

CERT-In names the actor CRAFTY FALCON and describes it as an AI-assisted financial threat actor that surveys targets with machine intelligence and strikes by invoking victims’ own payment and disbursement APIs. The campaign is ongoing; some entities that had already received restricted (TLP:AMBER) advisories and remediated were re-targeted after incomplete fixes, and attacks are timed for holidays, weekends and other low-monitoring windows (CERT-In CIAD-2026-0058).

The AI tooling. CERT-In lists the ARTEX family of LLM-based tools, PentAGI (an autonomous multi-agent AI penetration-testing system), Cairn (an attack search engine) and the CyberStrikeAI framework. It says these run full attack chains autonomously, generate and refine large numbers of attack scripts, and adapt payloads to how a target responds, while the attacker infrastructure rotates IP addresses within hours to days (CERT-In CIAD-2026-0058).

Who is targeted. The advisory covers BFSI broadly and names non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment aggregators, payment service providers, and cryptocurrency exchanges and other virtual digital asset service providers (CERT-In CIAD-2026-0058).

On the losses. CERT-In’s public advisory does not state an amount. Economic Times, citing highly placed sources, has reported roughly 300 crore rupees stolen from smaller NBFCs over about two months with more than 150 first information reports; neither CERT-In nor the Reserve Bank of India has confirmed that figure, and a separate 152 crore rupee loss at the exchange CoinDCX has been reported as its own, unrelated incident (MediaNama).

How the attacks work

CERT-In describes the methodology as (CERT-In CIAD-2026-0058):

  1. Cloud and serverless abuse. Using cloud management and serverless services, such as AWS Systems Manager and Lambda, to run commands and deploy files.
  2. Non-production as the way in. Entering through internet-exposed UAT, staging and test environments, then pivoting to production via shared credentials, tokens or network paths.
  3. Reverse engineering. Reading application code to build exploits and to make API calls with modified application packages.
  4. IP allow-list bypass. Routing traffic through whitelisted third-party fetcher IP pools so source-IP controls are defeated.
  5. Micro-value test transfers. Running a test transaction as small as one rupee to validate an unauthorised fund flow before attempting large transfers.
  6. Merchant-settlement API abuse. Exploiting or abusing payment aggregators’ merchant settlement APIs.
  7. Rapid vulnerability exploitation. Quickly weaponising newly published flaws, including file-upload and deserialisation chains that drop PHP and Node.js web shells.
  8. Crypto theft. Targeting exchanges and VASPs, including theft of wallet keys.
  9. AI-generated code. Producing large numbers of tailored, iteratively refined scripts, consistent with AI-generated attack code.

Am I affected?

  • You are in scope if you are an Indian BFSI entity that exposes payment, disbursement or merchant-settlement APIs: banks, NBFCs, digital lenders, fintech platforms, payment aggregators, payment service providers, and crypto or virtual digital asset service providers (CERT-In CIAD-2026-0058).
  • A partial clean-up is not safety. CERT-In says the actor re-scans and re-targets organisations that did not fully eradicate an earlier intrusion (CERT-In CIAD-2026-0058).
  • Smaller NBFCs appear most exposed, per Economic Times reporting, likely from lighter monitoring rather than any single flaw (MediaNama).
  • Customers of these institutions should watch for unexpected debits, especially a one rupee debit followed by a larger one.

What to do now

CERT-In’s recommendations, grouped (CERT-In CIAD-2026-0058):

  1. Payments. Monitor for micro-value test patterns and hold or review those flows; apply velocity rules, new-beneficiary cooling periods and amount-band anomaly detection; require server-side validation, maker-checker approval and reconciliation for merchant settlement instructions.
  2. Isolate non-production. Keep UAT, staging and test environments off the internet and give them no shared credentials, tokens or network path to production; alert on any non-production access to production.
  3. Cloud. Centralised real-time audit-log monitoring; restrict cloud management and serverless execution to approved principals; alert on production function-code changes; enforce metadata-service protection, least privilege, and deny wildcard or default serverless internet egress.
  4. Application hardening. Make deployment directories read-only to the runtime user and add file-integrity monitoring for web shells; treat clients as untrusted with server-side validation; use API request signing (nonce and timestamp), app attestation and certificate pinning.
  5. Identity over IP. Replace IP allow-listing of shared fetcher pools with mutual TLS, signed requests or scoped API keys.
  6. Patch fast. Set a rapid patch SLA for internet-facing apps, prioritising PHP and Node.js upload and deserialisation flaws, with WAF virtual patching as an interim control.
  7. Secrets and code. Ban hardcoded credentials, scan repositories and CI/CD for secrets, use short-lived least-privilege tokens, rotate build and deploy tokens, and enforce branch protection, commit signing and code review.
  8. Network. Default-deny egress from servers through allow-listed proxies; inspect TLS and alert on self-signed certificates on non-standard ports; apply zero trust, micro-segmentation and east-west inspection.
  9. Crypto custody. Hold wallet keys in HSMs or cold storage, require multi-signature withdrawal approval, monitor withdrawal patterns, and rotate keys immediately on suspected compromise.
  10. Tool governance and response. Prohibit unauthorised offensive AI tools on corporate infrastructure and monitor for their download; govern LLM API usage and keys; require written approval, defined scope and a time window for all penetration testing; run 24x7 monitoring with lower alert thresholds during low-coverage periods; and assume persistence after any incident, with full eradication, forensic verification and continuous threat hunting.
  11. Report it. Email incidents to CERT-In and CSIRT-Fin at incident@cert-in.org.in, and route bulk fraudulent transactions to I4C through the Cyber Fraud Mitigation Centre (CFCFRMS) portal.

Detection

The public advisory contains no indicators of compromise, infrastructure fingerprints or detection rules; those are in the restricted TLP version shared with BFSI entities. CERT-In’s general detection guidance is to alert on micro-value test transactions to new beneficiaries followed by high-value transfers; monitor web roots, temp directories and staging paths for bursts of new scripts and rapid variants; watch for AI coding-agent processes running with permission checks disabled and for LLM API traffic from servers or non-development hosts; deploy deception assets such as honeypots, decoy admin panels and canary credentials; and tune the SIEM for machine-speed, multi-technique attacks outside business hours (CERT-In CIAD-2026-0058).

This campaign is one part of a wider surge in real-world use of ARTEX and similar agentic pentest tools against organisations worldwide. See our advisory on the ARTEX ConnectWise and VAPOR PANDA activity.

Sources