CERT-In has warned banks, NBFCs and fintech firms about escalating AI-driven ‘Crafty Falcon’ cyberattacks. Hackers are exploiting banking APIs, system vulnerabilities and compromised credentials to execute fraudulent fund transfers, increasingly timing operations during weekends and holidays
Published Date – 5 November 2026, 06:04 PM
New Delhi: The Indian Computer Emergency Response Team (CERT-In) has issued a fresh warning to banks, non-banking financial companies (NBFCs), fintacech firms and other financial institutions following a rise in cyberattacks linked to unauthorised fund transfers.
CERT-In said it had observed a significant escalation in an ongoing cyber campaign, dubbed ‘Crafty Falcon’, which uses artificial intelligence-powered tools to automate attacks and rapidly exploit vulnerabilities in financial systems.
The advisory follows an earlier alert issued in October regarding the misuse of payment and disbursement application programming interfaces (APIs) to facilitate fraudulent fund transfers.
According to CERT-In, reports of successful intrusions continue to be received from banks, NBFCs and fintech companies, including some organisations that had already undertaken corrective measures following previous warnings.
In several cases, attackers returned to target entities where identified weaknesses had not been fully addressed.
Attackers have increasingly timed their operations to coincide with weekends, holidays and other periods of reduced security oversight, making detection and response more difficult, the watchdog said.
CERT-In’s investigation found that threat actors were leveraging publicly available AI-driven offensive security platforms capable of generating customised attack scripts, adapting malware based on system responses and carrying out large parts of the attack process with minimal human intervention.
Moreover, attackers are exploiting internet-facing testing environments, cloud infrastructure, application vulnerabilities and compromised credentials to gain access to critical systems.
Modified mobile applications and unauthorised API calls have been used to initiate fraudulent transactions.
The advisory also highlighted tactics such as routing malicious traffic through trusted third-party services to bypass security controls and using low-value transactions to test compromised systems before attempting larger fund transfers.
Earlier in October, several lenders witnessed cyberattacks, including those targeting leading banking institutions such as the State Bank of India, AU Small Finance Bank and Spandana Sphoorty.
