The Indian Computer Emergency Response Team (CERT-In) has issued a critical advisory warning of escalating AI-driven attacks targeting banking, financial services and insurance (BFSI) entities. The advisory, issued on November 4, updates its October 9 advisory on the exploitation of payment and disbursement APIs for unauthorised fund transfers.

 CERT-In’s Computer Security Incident Response Team-Finance (CSIRT-Fin) has designated the threat actor behind the campaign as ‘CRAFTY FALCON’. The agency identified the use of publicly available AI-driven offensive tools, including the ARTEX family of large language model-based tools, PentAGI, an autonomous multi-agent AI penetration testing system, the Cairn attack search engine, and the CyberStrikeAI framework.

CERT-In’s Analysis of Reported Incidents: CRAFTY FALCON has targeted cloud infrastructure, including compute, serverless, and management services, abusing AWS Systems Manager and Lambda to execute commands and deploy malicious files. Additionally, attackers have used internet-exposed non-production environments, such as testing and staging systems, to access production environments through shared credentials, tokens, and network paths.

The threat actor has also reverse-engineered application codebases to develop tailored exploits and initiate unauthorised API calls through modified application packages. Moreover, attackers have bypassed IP allow-listing by routing traffic through shared third-party fetcher IP pools, including content-acceleration and app-store review services.

CERT-In reported that attackers conducted micro-value transactions, such as Rs 1 transfers, to validate unauthorised fund flows before executing larger transactions. They also exploited merchant settlement APIs, targeted newly disclosed vulnerabilities in PHP and Node.js applications, and stole cryptocurrency wallet keys. The agency said attacks continued against entities that had already undertaken remediation, including during weekends and holidays.

CERT-In’s Recommendations: CERT-In has advised BFSI entities to maintain 24×7 security monitoring, increase staffing during weekends and holidays, and conduct forensic verification after incidents to identify persistent threats. It has also recommended isolating testing and staging environments from production systems, eliminating shared credentials, and implementing real-time monitoring of cloud audit logs.

Furthermore, entities should enforce server-side transaction validation, API request signing, app attestation, and certificate pinning. CERT-In has called for rapid patching of internet-facing applications, particularly file-upload and deserialization vulnerabilities in PHP and Node.js.

For payment security, the agency has recommended monitoring micro-value transactions followed by high-value transfers, implementing beneficiary cooling periods and enforcing maker-checker approvals for merchant settlements. Entities should also use multi-signature approvals for cryptocurrency withdrawals and report suspicious activity to CERT-In/CSIRT-Fin.

What the agency had previously flagged: In an advisory issued on October 9, 2026, CERT-In and its finance-related cybersecurity arm, CSIRT-Fin, warned NBFCs, digital lending platforms, fintech firms, payment service providers, and wallet operators about cyberattack campaigns exploiting payment and disbursement APIs. The agency said attackers compromised internet-facing applications and exposed APIs and privileged endpoints to steal payment-gateway and partner-bank credentials. 

They then invoked fund-transfer APIs from entities’ whitelisted infrastructure, bypassing application-level controls, including KYC, beneficiary verification and transaction limits. CERT-In also flagged the possible use of AI-assisted offensive tools, noting that the interval between initial compromise and fraudulent transfers had reduced. Additionally, attackers deleted logs, tampered with endpoint detection and response tools, and conducted anti-forensic cleanup. 

Also read:

The post CERT-In flags an AI threat actor targeting BFSI payment APIs for unauthorized fund transfers appeared first on MEDIANAMA.