India’s cybersecurity watchdog CERT-In has issued a critical warning to entities in the banking, financial services and insurance (BFSI) sector over an escalating campaign of AI-driven cyberattacks targeting payment and disbursement APIs.

In an advisory dated November 4, 2026, the Indian Computer Emergency Response Team (CERT-In) identified the threat actor behind the campaign as ‘CRAFTY FALCON’, describing it as an AI-assisted financial threat actor that uses machine intelligence to identify targets, execute attacks at machine speed and exploit victims’ own payment and disbursement APIs to initiate unauthorised fund transfers.

Banks, non-banking financial companies (NBFCs), fintech companies and other financial services entities have been warned of the growing threat.

CERT-In’s Computer Security Incident Response Team-Finance (CSIRT-Fin) said the campaign has witnessed a significant escalation, with successful attacks continuing to be reported across the financial services ecosystem. The agency has urged all BFSI entities to treat the campaign as an immediate and continuing threat.

A key concern highlighted in the advisory is the threat actor’s continued targeting of financial entities that had already received earlier restricted advisories and undertaken remediation measures.

According to CERT-In, some of these organisations have been deliberately targeted again, including cases where remediation was incomplete. The attacks have also been timed to coincide with holidays, weekends and other periods of reduced monitoring, potentially delaying detection and response.

CERT-In’s analysis identified the use of multiple publicly available AI-driven offensive security tools in the campaign. These include the ARTEX family of large language model (LLM)-based tools, PentAGI, an autonomous multi-agent AI penetration testing system, and the Cairn attack search engine, alongside the CyberStrikeAI framework.

Source link