CERT-In flags AI-driven cyberattacks targeting NBFCs, fintech firms

India's cybersecurity agency has issued a critical alert warning financial institutions of an escalating campaign of AI-driven cyberattacks targeting non-banking financial companies (NBFCs), fintech firms, digital lenders and payment aggregators.

In an advisory issued on November 4, the Indian Computer Emergency Response Team (CERT-In) identified the threat actor as 'CRAFTY FALCON' and said attackers were using publicly available artificial intelligence tools to automate cyberattacks and exploit payment and disbursement APIs to carry out unauthorised fund transfers.

The agency said the attacks had continued even against NBFCs and fintech companies that had received earlier warnings and taken corrective measures. Some firms were deliberately targeted again after incomplete remediation, with attackers timing their operations around weekends and holidays when security monitoring is typically lower.

CERT-In identified four AI-driven offensive security tools being used in the campaign: ARTEX, PentAGI, Cairn and CyberStrikeAI. These tools can automate attack operations, generate customised scripts and modify their approach based on how target systems respond.

The attackers have also been using small-value transactions, including payments of Re 1, to test unauthorised fund transfers before attempting larger transactions. Other methods include exploiting merchant settlement APIs, accessing poorly secured testing environments and stealing cryptocurrency wallet keys.

The advisory also flagged the exploitation of newly disclosed software vulnerabilities in PHP and Node.js applications, with attackers using them to gain unauthorised access to systems.

CERT-In has asked financial institutions to strengthen round-the-clock security monitoring, particularly during weekends and holidays, isolate testing environments from production systems and introduce additional checks for payment transactions.

It has also recommended additional verification for new beneficiaries, transaction limits, multi-level approval for merchant settlements and stronger safeguards for cryptocurrency wallet keys.

Last month, CERT-In had said that AI agents accessed live systems of Indian organisations and read records containing personal data and confidential business information during research and testing. It did not name the AI providers or the organisations involved.

Days later, State Bank of India (SBI), the country's largest lender, reported a suspected exposure of customer data on the dark web, with 3,897 customer records containing personal information identified during a preliminary analysis.