CERT-In Warns Banks, Fintech Firms of AI-Driven Cyberattacks

News

1. Cyber Breaches Hit 86% of Companies as AI Widens Security Skills Gap

2. Anthropic Strikes $3.4 Billion Deal for Gas-Fired Power Generators

3. OpenAI Launches BioBasicsBench to Test AI Agents on Laboratory Tasks

4. Coforge Joins SpaceX Partner Network to Bring Grok AI to Enterprises

5. Meta Warns US Midterm Backlash Could Slow Data Center Expansion

6. Google to Invest $17 Billion in Wyoming Data Center Despite US Backlash

India’s cybersecurity agency has warned banks, fintech companies and other financial firms of an ongoing AI-assisted cyberattack campaign targeting payment systems to carry out unauthorized fund transfers.

The Indian Computer Emergency Response Team said on November 4 that its financial-sector response unit, CSIRT-Fin, had identified the threat actor behind the campaign as “CRAFTY FALCON” and described the activity as active and ongoing.

The campaign has affected non-banking financial companies, digital lenders, payment aggregators, payment service providers and cryptocurrency exchanges.

According to CERT-In, attackers are using publicly available AI-assisted security tools, including ARTEX, PentAGI, Cairn and CyberStrikeAI, to automate intrusions, generate attack scripts and adapt their methods to targeted systems.

Attackers have exploited cloud infrastructure and internet-facing test environments to gain access to production systems through shared credentials, tokens and network connections. They have also manipulated payment and merchant settlement application programming interfaces (APIs) to transfer funds.

In some cases, hackers made test transactions of as little as ₹1 before attempting larger transfers. Earlier attacks involved routing stolen funds through mule accounts at multiple banks, followed by rapid withdrawals, the agency said.

CERT-In also reported attacks on cryptocurrency businesses involving stolen wallet keys and unauthorized transfers.

Some financial institutions were targeted again despite taking corrective measures after earlier warnings. Attacks were also timed around weekends and holidays, when security monitoring was reduced.

The agency urged financial firms to maintain round-the-clock monitoring, separate testing and production systems, strengthen payment API security and flag unusual transactions.

It also asked affected institutions to report suspicious activity to CERT-In and CSIRT-Fin and contact the Indian Cyber Crime Coordination Centre to facilitate the reporting and freezing of fraudulent transfers.

The warning follows an October 15 CERT-In advisory that said AI agents had already been involved in unauthorized access to Indian ICT systems, including cases where research agents exceeded their assigned permissions and separate incidents involving open-source agentic tools used for financially motivated attacks.