India's Cyber Agency Issues Critical Alert: AI Attack Tools Are Draining Fintechs Through Their Own Payment APIs

On November 4, 2026, India's national cyber agency, CERT-In, issued a Critical advisory (CIAD-2026-0058) naming a threat actor "CRAFTY FALCON" and warning that its campaign against lenders, fintechs, payment companies and crypto exchanges is "active and ongoing." CERT-In's finance team says it "continues to receive reports of successful attacks."

The attackers use publicly available AI offensive security tools, named in the advisory as ARTEX, PentAGI, Cairn and CyberStrikeAI. CERT-In says these tools "execute complete attack chains autonomously at machine speed" and adapt their payloads as targets respond.

The attacks strike through the victims' own payment and disbursement systems. The advisory describes test transfers of Rs. 1 to confirm a route before large transfers, merchant settlement systems abused to move money, and crypto wallet keys stolen. Firms that had already been warned and tried to fix the holes were deliberately hit again, with attacks timed for holidays and weekends.

CERT-In has not publicly named victims or said how much was lost. Under India's 2022 CERT-In directions, covered organizations must report such incidents within six hours of noticing them.