India warns financial firms of AI driven cyber attacks

India’s cyber authorities have warned of new AI-driven attacks targeting financial and crypto businesses, carried out by a previously unidentified actor named Crafty Falcon.

CERT-In’s advisory, issued on 4 November 2026, reports that non-banking financial companies including digital lending platforms, fintech firms, payment aggregators, payment services providers and cryptocurrency exchanges have suffered repeated intrusions, with attacks initially flagged in early October via restricted advisories that noted exploitation of APIs used for payments and disbursements to make unauthorized transfers.

CERT-In’s Finance branch, CERT-Fin, described Crafty Falcon as using AI and agentic AI tools to breach victim networks, moving from non-production environments into production by exploiting shared credentials and tokens, reverse-engineering codebases to tailor exploits, and deploying altered application packages to trigger unauthorized API calls.

The group is said to target cloud infrastructure and to abuse cloud management services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files, blending in with legitimate operations. Before large-value transfers, the actor allegedly performs micro-value tests to validate illicit fund flows, and exploits merchant settlement APIs belonging to payment aggregators to move funds. In cryptocurrency contexts, Crafty Falcon is reported to steal wallet keys and siphon funds.

CERT-In and CERT-Fin note the use of AI-powered offensive tools—including ARTEX, CyberStrikeAI, and Cairn—and warned that vulnerabilities are exploited as soon as they become public. To mitigate the threat, CERT-In’s advisory recommends heightened monitoring, strict cloud-access controls, segmentation, strict API validation, patching SLAs, and reporting suspicious activity to CERT-In and the I4C/CFCFRMS.