CERT-In Warns Banks and Fintech Firms of Critical AI Cyberattacks

CERT-In Sounds Critical Alert Over AI-Driven Financial Cyberattacks

India's cybersecurity authorities have issued a critical warning to banks, non-banking financial companies (NBFCs), fintech firms and payment service providers following an escalation in artificial intelligence-assisted cyberattacks targeting financial infrastructure.

The Indian Computer Emergency Response Team (CERT-In) issued a critical-severity advisory on November 4, 2026, identifying an active threat campaign designated CRAFTY FALCON.

The warning follows reports of successful cyber intrusions involving unauthorised fund transfers through payment and disbursement application programming interfaces (APIs).

The Indian Cyber Crime Coordination Centre (I4C), operating under the Ministry of Home Affairs, has also warned financial institutions about attackers using AI agents to compromise systems and execute fraudulent transactions at machine speed.

Authorities have identified cases involving unauthorised transfers worth multiple crores of rupees.

The attacks are particularly concerning because criminals can exploit vulnerable applications, automate successive stages of an intrusion and move funds before conventional monitoring systems respond.

CERT-In has instructed financial institutions to maintain heightened security monitoring, strengthen payment infrastructure and treat the campaign as an immediate and continuing threat.

The advisory also highlights incidents in which organisations were targeted again after attempting to remediate earlier vulnerabilities.

The development underscores growing cybersecurity risks for India's rapidly expanding digital financial ecosystem.

Key Highlights of CERT-In's November 2026 Cybersecurity Alert

The November 4 alert updates an earlier CERT-In advisory issued on October 9, 2026, concerning the exploitation of payment and disbursement APIs.

What Is the CRAFTY FALCON Cyber Threat?

CRAFTY FALCON is the designation assigned by CERT-In's Computer Security Incident Response Team – Finance (CSIRT-Fin) to an AI-assisted financial cyber threat actor.

According to the advisory, the campaign uses publicly available AI-driven offensive security tools to identify weaknesses, develop tailored exploits and conduct attacks at unusually high speed.

The threat actor has targeted financial organisations through vulnerable applications, cloud infrastructure and payment interfaces.

Unlike attacks that depend heavily on manual execution, AI-assisted operations can automate several stages of a cyber intrusion.

These may include vulnerability identification, adaptation of malicious scripts and attempts to exploit exposed systems.

The resulting speed can reduce the time available for security teams to detect and contain suspicious activity.

However, the use of AI does not mean that every stage of an attack is necessarily autonomous.

The central concern is the ability of attackers to combine automation, existing vulnerabilities and financial transaction systems to conduct rapid fraud.

AI Agents Increase the Speed of Cyberattacks

Artificial intelligence agents can perform sequences of tasks with limited direct human intervention.

In cybersecurity, similar capabilities can be used legitimately for testing, monitoring and vulnerability assessment.

However, criminals can misuse AI-enabled tools to accelerate malicious activities.

CERT-In identified the use of several publicly available offensive security frameworks in the CRAFTY FALCON campaign.

These include ARTEX, PentAGI, Cairn and CyberStrikeAI.

The tools can support automated testing, script generation and adaptation of attack techniques.

The advisory indicates that attackers have used these capabilities to create numerous tailored scripts and modify their methods in response to target systems.

This creates challenges for security teams relying on static detection rules.

Traditional controls may struggle when attackers rapidly change their techniques or infrastructure.

The financial consequences can be severe when automated attacks reach payment systems.

How AI-Powered Attacks Threaten Financial Institutions

Financial institutions operate interconnected systems that process customer requests, account information and transactions.

These systems frequently communicate through APIs.

An API allows software applications to exchange information and perform authorised functions.

Banks and fintech firms use APIs for services including account verification, merchant settlement, payment processing and loan disbursement.

These connections improve efficiency but can also create security risks if access controls are weak.

CERT-In has identified attacks in which criminals compromise vulnerable infrastructure and subsequently misuse legitimate payment interfaces.

The attackers may not need to create an entirely new payment mechanism.

Instead, they attempt to exploit weaknesses in systems already authorised to move money.

This makes strong authentication, transaction validation and monitoring essential.

Payment and Disbursement APIs Are Major Targets

The advisory places particular emphasis on payment and disbursement APIs.

These interfaces can initiate financial transactions when properly authorised.

Criminals who obtain unauthorised access may attempt to use them to transfer funds.

CERT-In identified suspicious activity involving small test transactions followed by larger unauthorised transfers.

Such patterns can indicate that attackers are attempting to verify whether compromised payment access works before initiating more significant transactions.

The agency has recommended monitoring unusual payment patterns, including transactions involving new beneficiaries.

Financial institutions have also been advised to strengthen approval controls and transaction validation.

The objective is to prevent compromised applications or credentials from becoming a direct route to financial loss.

Cloud Infrastructure Has Become an Important Attack Surface

Modern financial institutions increasingly depend on cloud infrastructure.

Cloud platforms support application hosting, data processing, customer services and operational management.

However, misconfigured cloud services or compromised credentials can create opportunities for unauthorised access.

CERT-In's advisory identifies abuse of cloud management services as one technique associated with the campaign.

Attackers have attempted to blend malicious activity with legitimate administrative operations.

This can make suspicious behaviour difficult to distinguish from authorised maintenance.

Financial institutions have therefore been advised to strengthen monitoring of cloud audit logs and high-risk administrative actions.

Access to sensitive cloud management functions should be restricted to authorised users and services.

The advisory also emphasises the importance of monitoring changes to permissions, credentials and application configurations.

Testing Environments Can Expose Production Systems

A notable concern identified by CERT-In involves non-production environments.

Financial institutions often maintain development, testing and staging systems before deploying applications to customers.

These environments may contain software configurations similar to production systems.

However, they can sometimes receive less security attention.

CERT-In identified cases in which attackers exploited internet-facing testing environments and subsequently attempted to access production infrastructure.

The risk increases when development and production systems share credentials, access tokens or network connections.

The agency has recommended stronger separation between these environments.

Testing systems should not provide an unrestricted route to sensitive financial infrastructure.

Attackers Have Returned After Incomplete Remediation

One of the most serious findings in the November 4 advisory is that some affected organisations experienced further attacks after implementing security measures.

CERT-In indicated that attackers deliberately targeted institutions where earlier remediation had been incomplete.

This suggests that addressing a single visible vulnerability may not be sufficient.

An attacker may retain access through compromised credentials, additional weaknesses or previously established persistence mechanisms.

Consequently, incident response must extend beyond restoring affected services.

Financial institutions need to determine whether unauthorised access has been fully eliminated.

The advisory recommends forensic verification and continued threat hunting following an incident.

These measures are intended to identify remaining compromises and reduce the likelihood of repeated attacks.

Cyberattacks Timed Around Holidays and Weekends

CERT-In also warned that attackers have timed operations to coincide with periods when security monitoring may be reduced.

These include weekends, holidays and other low-staffing windows.

Financial institutions may operate essential payment services continuously, even when administrative teams have reduced coverage.

Attackers can exploit this difference between operational availability and security staffing.

The advisory therefore recommends heightened monitoring throughout the day and night.

Institutions have been advised to increase staffing and adjust alert thresholds during periods of reduced coverage.

The objective is to ensure that suspicious activity receives timely attention regardless of when it occurs.

Unauthorised Transfers Can Move Through Multiple Accounts

The I4C warning highlights the risk of stolen funds being transferred through multiple accounts.

Cybercriminals may route money into accounts used to receive or move illicit proceeds, commonly known as mule accounts.

Funds can then be transferred onward or withdrawn rapidly.

India's digital payment infrastructure enables legitimate transactions to move efficiently.

However, criminals can attempt to misuse these capabilities after compromising payment systems.

Authorities have highlighted unauthorised transfers involving IMPS and NEFT channels.

The concern is not that these payment systems are inherently compromised.

Rather, attackers may exploit a financial institution's authorised interfaces to initiate fraudulent transactions.

Once funds move across several accounts, recovery and investigation can become more difficult.

Attackers Attempt to Conceal Digital Evidence

Cyber investigations depend heavily on transaction records, access logs and other digital evidence.

The I4C advisory warns that criminals have attempted to delete records and conceal their activities after transferring funds.

This can complicate efforts to reconstruct an incident.

It may also delay identification of compromised accounts and systems.

Financial institutions therefore need reliable logging and evidence preservation arrangements.

Security teams must be able to investigate suspicious activity even when attackers attempt to interfere with records.

CERT-In has advised organisations to preserve relevant forensic evidence when responding to suspected compromises.

The ability to reconstruct events is essential for incident containment, regulatory reporting and recovery efforts.

Financial Institutions Face Multiple Cybersecurity Risks

The advisory makes clear that effective defence requires multiple layers of security rather than reliance on a single control.

CERT-In Calls for Continuous Security Monitoring

CERT-In has urged financial institutions to maintain heightened security monitoring around the clock.

The agency has specifically highlighted the need for stronger coverage during holidays and weekends.

Institutions have been advised to improve the detection of unusual cloud activity, suspicious payment transactions and unexpected application changes.

Security monitoring should also identify abnormal use of access credentials.

Rapid incident containment is particularly important when attacks involve automated payment systems.

However, monitoring alone cannot prevent every compromise.

It must be supported by strong access controls, secure software development and effective incident response.

The advisory reflects the need for financial institutions to adapt security operations to increasingly automated threats.

Banks and Fintech Firms Urged to Strengthen API Security

API security is a central component of the government's recommendations.

Financial institutions have been advised to maintain a comprehensive inventory of payment-related APIs.

Unused, obsolete and testing interfaces should be disabled where they are no longer required.

Sensitive transactions should be validated by trusted server-side systems rather than relying only on requests received from customer applications.

Institutions should also apply appropriate authentication and authorisation controls.

CERT-In has recommended additional safeguards for merchant settlements and other high-risk transactions.

These measures are intended to prevent attackers from misusing compromised software or credentials to initiate payments.

Six-Hour Cyber Incident Reporting Requirements Remain Important

The I4C and CERT-In warning reinforces the importance of timely incident reporting.

Financial institutions are expected to report applicable cybersecurity incidents to CERT-In within six hours of detection or notification, in accordance with relevant requirements.

Banks and NBFCs also face reporting obligations to the Reserve Bank of India.

The advisory highlights the RBI's DAKSH portal as a reporting channel for relevant incidents.

Prompt reporting can help authorities coordinate responses and identify broader attack patterns.

However, institutions must follow the reporting requirements applicable to their specific regulatory category.

Reporting an incident does not replace the need to contain the attack, preserve evidence and investigate its cause.

Cybersecurity Reporting and Response Framework

Coordination among these functions is particularly important when incidents involve multiple financial institutions.

India's Digital Financial Ecosystem Faces Growing Cyber Risks

India has developed a large digital financial ecosystem covering banking, online lending, payment services and financial technology.

Digital transactions have improved access to financial services and reduced dependence on cash-based processes.

However, increased connectivity also creates additional cybersecurity responsibilities.

Banks and fintech firms operate complex networks of applications, service providers and payment interfaces.

A weakness in one connected system can create risks for other operations.

The growing use of automation further increases the importance of secure system design.

CERT-In's warning highlights the need to treat cybersecurity as an essential part of financial infrastructure.

Cyber Fraud Complaints Highlight the Scale of the Challenge

Government data cited in reporting on the advisory indicates that more than 53.87 lakh cyber fraud complaints were registered between FY2023–24 and FY2025–26.

Over the same period, more than 1.81 lakh first information reports were registered.

The reported amount involved in cyber fraud exceeded ₹56,087 crore.

More than ₹9,079 crore was marked as lien, while over ₹206 crore was refunded to victims.

These figures reflect the broader cyber fraud landscape and should not be interpreted as losses caused specifically by CRAFTY FALCON.

They nevertheless illustrate the scale of financial cybercrime concerns in India.

The latest advisory adds a further dimension by identifying the use of AI-assisted tools in attacks against financial institutions.

Why AI-Assisted Cybercrime Is a Significant Development

Cybercriminals have used automation for many years.

However, AI-assisted tools can make certain activities faster and more adaptable.

Attackers may be able to generate scripts, modify techniques and respond to defensive measures more quickly.

This creates challenges for security teams that depend on manually reviewing large volumes of alerts.

The issue is particularly serious for financial institutions because payment systems can transfer funds rapidly.

The consequences of delayed detection may therefore be immediate and financial.

However, AI is not inherently responsible for cybercrime.

The risk arises when criminals misuse technology alongside weaknesses in infrastructure, authentication and operational controls.

The advisory reinforces the importance of strengthening those underlying safeguards.

Implications for Banks, NBFCs and Fintech Companies

The warning has significant implications for India's financial services industry.

Banks may need to review payment infrastructure and security monitoring arrangements.

NBFCs and digital lenders face risks associated with automated loan disbursement systems.

Payment aggregators must ensure that merchant settlement instructions are properly validated.

Fintech firms may need to strengthen controls around third-party integrations and cloud infrastructure.

Digital asset service providers face additional risks involving wallet security and unauthorised withdrawals.

These organisations operate different business models, but all depend on reliable digital systems.

Cybersecurity failures can create financial losses, operational disruption and reputational damage.

Financial Sector Cybersecurity Priorities

These measures are particularly important for institutions processing large transaction volumes.

Cybersecurity Investment Could Increase

The advisory may encourage financial institutions to reassess cybersecurity budgets and operational capabilities.

Banks and fintech companies may need to invest in improved monitoring, secure application development and incident response.

Demand could increase for specialised cybersecurity services, including threat detection, cloud security and fraud analytics.

However, the financial impact on individual technology vendors will depend on customer spending decisions.

No specific procurement commitments or cybersecurity contracts were announced as part of the advisory.

The broader implication is that financial institutions may need to strengthen their security infrastructure to address increasingly sophisticated threats.

Customer Trust and Financial Stability Remain Central

Cybersecurity is essential to maintaining confidence in digital financial services.

Customers depend on banks and payment providers to protect account information and prevent unauthorised transactions.

A significant breach can affect confidence even when the underlying financial institution remains operational.

Repeated incidents may also create regulatory and reputational consequences.

For the broader financial system, strong cybersecurity supports reliable transaction processing and operational continuity.

The latest warning therefore extends beyond individual fraud cases.

It highlights the importance of maintaining resilient digital infrastructure as India's financial sector continues expanding.

What Financial Institutions Should Prioritise

CERT-In's recommendations emphasise practical security improvements across infrastructure, applications and financial transactions.

Institutions should identify sensitive payment interfaces and ensure that access is appropriately restricted.

They should strengthen monitoring of unusual transactions and administrative activity.

Security teams must also verify that earlier vulnerabilities have been fully remediated.

Testing environments should be separated from production systems.

Incident response procedures should support rapid containment and evidence preservation.

These measures require coordination between cybersecurity teams, application developers, payment operations and senior management.

The effectiveness of the response will depend on implementation rather than policy documentation alone.

Outlook for Financial Sector Cybersecurity

The CRAFTY FALCON campaign demonstrates how AI-assisted offensive tools can increase the speed and complexity of financial cyberattacks.

CERT-In has characterised the threat as active and escalating.

The immediate priority for affected institutions is to identify exposure, strengthen monitoring and prevent unauthorised access to payment infrastructure.

Over the longer term, financial institutions may need to incorporate stronger security controls throughout software development and transaction processing.

Cybersecurity investment is likely to remain important as financial services become more automated.

However, the scale of future incidents will depend on how effectively organisations implement security measures and respond to emerging threats.

Conclusion

CERT-In's November 4, 2026, critical-severity advisory marks an important development in India's response to AI-assisted financial cybercrime.

The agency has identified CRAFTY FALCON as an active threat campaign targeting banks, NBFCs, fintech firms and payment service providers.

The attacks exploit weaknesses in applications, cloud infrastructure and payment APIs to conduct unauthorised financial transactions at machine speed.

Authorities have also warned that some organisations were targeted again after incomplete remediation.

The advisory calls for heightened 24-hour monitoring, stronger payment security, rapid vulnerability management and timely incident reporting.

For India's financial industry, the central challenge is ensuring that increasingly connected and automated systems remain secure against rapidly evolving cyber threats.

The warning reinforces the need for cybersecurity to remain a core operational priority across banking, fintech and digital payments.