Science & Tech · Cybersecurity · 2 hrs ago
India Warns of AI-Assisted Cyber-Attacks on Financial Firms
India’s CERT-In says a threat actor called Crafty Falcon is carrying out active cyber-attacks on financial businesses in the country.
The targets include non-bank lenders, fintech firms, payment providers, banks and cryptocurrency exchanges.
The attackers use publicly available AI-powered security tools to automate parts of their operations and quickly adapt scripts to targets.
They can enter through exposed test systems, then use shared credentials or network links to reach production systems.
The attacks can bypass payment safeguards and move money, including by abusing payment APIs and testing unauthorized transfers with small amounts first.
CERT-In says some firms were attacked again after an earlier warning, citing incomplete fixes, and that crypto businesses have lost wallet keys and funds.
The threat remains active, and CERT-In has also published guidelines for securing AI systems, but no specific next action against Crafty Falcon was stated.
India’s CERT-In says an active threat actor known as Crafty Falcon is using AI-assisted tools to attack financial firms and cryptocurrency businesses.
The agency says attackers exploit exposed non-production systems and APIs to reach production environments and make unauthorized transfers.
Attacks have also targeted cryptocurrency exchanges and digital asset service providers, with keys and funds stolen.
CERT-In says the attackers use automated tools to generate and refine scripts, and often operate during periods when monitoring is low.
The warning follows an earlier alert to financial organizations in October 2026.
- Who
- CERT-In has warned about Crafty Falcon, a previously undocumented threat actor.
- What
- The actor is using AI-assisted tools in cyber-attacks against financial organizations and cryptocurrency businesses.
- When
- CERT-In published a security advisory on November 4. The activity is described as ongoing.
- Where
- Organizations in India, including financial firms and cryptocurrency exchanges, are being targeted.
- Why
- The sources describe the attackers’ methods and targets but do not state their motive.
This story does not have two clearly opposing sides.
Some financial organizations received a restricted-distribution advisory warning about attacks exploiting payment and disbursement APIs.
CERT-In issued an alert about cyber-attack campaigns targeting non-banking financial companies and other financial and cryptocurrency businesses.
CERT-In published a security advisory describing Crafty Falcon’s attacks and methods.
Infosecurity Magazine and The Hacker News published reports on CERT-In’s warning.
- Threat actor
- Crafty Falcon
- Advisory date
- November 4, 2026
- Target organizations
- Financial firms, including fintech companies and payment providers, and cryptocurrency exchanges
- Test transaction
- Rs. 1
- AI tools named
- ARTEX, Cairn and CyberStrikeAI
- Exposed environments
- User acceptance testing, staging and testing environments
3 sources
What people are saying
These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession, and adapt their payloads based on target responses
incomplete remediation