India’s cyber response agency has warned that attackers are using AI-enabled tools to automate intrusions against NBFCs, fintechs, payment firms and other financial institutions.
The Indian Computer Emergency Response Team (CERT-In) has issued a critical advisory on an active campaign targeting non-banking financial companies, digital lending platforms, fintech entities, payment aggregators, payment service providers and cryptocurrency exchanges. The agency has designated the threat actor as ‘Crafty Falcon’.
According to CERT-In, attackers are using publicly available AI-driven offensive security tools, including large-language-model-based and autonomous multi-agent systems, to conduct reconnaissance, generate and refine attack scripts and adapt their activity to target responses. The campaign has focused on exploiting payment and disbursement APIs to facilitate unauthorised fund transfers.
CERT-In says some organisations have been targeted again after incomplete remediation. Attackers have also timed activity around weekends, holidays and other low-monitoring periods in an attempt to delay detection and response.
The agency has advised financial entities to strengthen identity-based access, adopt zero-trust principles, segment networks, monitor exposed systems and use deception measures such as honeypots and decoy administrative panels. It has also urged organisations to isolate affected hosts, preserve forensic evidence, rotate credentials and report suspicious activity promptly.
Why it matters for BFSI: The warning has direct relevance for CISOs, CIOs, fraud teams and technology risk leaders. It makes API security, privileged access, continuous monitoring and incident response essential board-level priorities.
Source: CERT-In Advisory CIAD-2026-0058, 4 November 2026; Reuters, 5 November 2026
