India Issues Urgent Cybersecurity Warning as AI Cyberattacks Target Financial Firms at Machine Speed

India's cybersecurity agencies have issued urgent warnings to financial institutions about a dramatic escalation in AI cyberattacks targeting banks and non-bank lenders, cryptocurrency exchanges, and fintech companies. The Indian Cybercrime Coordination Centre (I4C) and the Indian Computer Emergency Response Team (CERT-In) have identified a sophisticated threat actor operating at machine speed, exploiting vulnerabilities to execute unauthorised fund transfers running into crores of rupees.1

1

3

CRAFTY FALCON Emerges as AI-Assisted Financial Threat

CERT-In has designated the threat actor behind this campaign as CRAFTY FALCON, described as an AI-assisted financial threat actor that surveys targets with machine intelligence and strikes by invoking victims' own payment and disbursement APIs. The National Cybercrime Threat Analysis Unit (NCTAU) under I4C flagged that attackers are exploiting unpatched software and misconfigured internet-facing servers to gain access to financial infrastructure.2

2

4

The threat remains active and ongoing, with CSIRT-Fin continuing to receive reports of successful attacks. Notably, entities that had already received earlier restricted advisories and undertaken remediation have been deliberately re-targeted, including after incomplete remediation. Attacks have been strategically timed to coincide with holidays, weekends, and other low-monitoring windows to delay detection and response.3

3

Machine Speed Attacks Using Advanced AI Tools

The advisory reveals that attackers are deploying multiple publicly available AI-driven offensive security tools against affected entities. These include the ARTEX family of LLM-based tools, the PentAGI autonomous multi-agent AI penetration testing system, and the Cairn attack search engine, in addition to the CyberStrikeAI framework. These agentic AI systems execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession, and adapt their payloads based on target responses.3

3

4

According to CERT-In, AI tools helped attackers rapidly generate and refine attack scripts while reverse-engineering application code to develop tailored exploits. In some incidents, attackers used small test transactions to validate unauthorised transfers before moving larger sums, demonstrating a calculated approach to financial theft.2

2

Cryptocurrency Exchanges Among Targeted Entities

The campaign has targeted a broad range of financial entities, including NBFCs, digital lending platforms, fintech companies, payment aggregators, and service providers. CERT-In's latest advisory explicitly identified cryptocurrency exchanges among affected businesses, reporting stolen cryptocurrency wallet keys and funds drained from wallets. The agency did not name specific affected crypto exchanges or quantify losses.2

2

Attackers exploited vulnerable applications and exposed testing environments, using shared credentials and access tokens to move into production systems. They also targeted cloud infrastructure to deploy malicious files, demonstrating sophisticated knowledge of modern financial technology architectures.2

2

Related Stories

AI Agents Access Indian Firms' Data Without Authorization as CERT-In Sounds Alarm

India's RBI joins global regulators to assess Mythos AI cybersecurity risks amid access concerns

AI Agents Are Operating Unmonitored in 80% of Companies, Creating a New Cybersecurity Battlefield

AI drives global cyber fraud crisis but experts say it holds the key to solving it

Multi-Crore Frauds Through Mule Accounts

The I4C advisory described the complete attack chain used by cybercriminals. Once inside compromised systems, attackers target automated fund disbursement systems and APIs used for payments and transfers. Perpetrators then route funds through mule accounts across different banks and quickly move to withdraw proceeds via IMPS and NEFT. The cybercriminals delete records and hide their tracks to make investigations more difficult.4

4

5

Customer-facing complaint interfaces have been identified as potential entry points for cybercriminals, highlighting vulnerabilities in systems designed for customer service rather than high-security transactions.4

4

Heightened Security Measures and Six-Hour Reporting Mandate

CERT-In has advised all BFSI entities to treat this campaign as an immediate and continuing threat, maintaining heightened 24x7 security monitoring with increased staffing and lowered alert thresholds during holidays, weekends, and other low-coverage windows. Financial institutions must implement comprehensive security measures, including maintaining a complete inventory of all payment APIs and disabling obsolete, unused, and testing interfaces.3

3

4

The advisory mandates that financial institutions report cyber incidents to CERT-In within six hours of detection. Banks and NBFCs are also required to report incidents to the Reserve Bank of India through its DAKSH portal within the same timeframe. This six-hour reporting requirement aims to enable authorities and regulators to respond quickly to attacks and limit damage.5

5

Institutions should set transaction limits, verify beneficiary details, monitor sudden changes in transaction speeds, volumes and patterns, and ensure KYC and approval checks are completed before funds are transferred. The advisory also recommends conducting authorised red-team exercises to test how quickly security and payment controls respond to machine speed attacks.4

4