India’s cyber security agency has named the hacking group behind a wave of AI-driven attacks on financial firms. In an advisory issued on 4 November 2026, the Indian Computer Emergency Response Team (CERT-In) said a threat actor it calls “Crafty Falcon” is using publicly available AI tools to break into non-bank lenders, fintech firms, payment aggregators and cryptocurrency exchanges, and warned that the threat is “active and ongoing”.

The advisory came from CERT-In’s Computer Security Incident Response Team for Finance (CSIRT-Fin), based on incidents reported by affected BFSI entities. It follows the agency’s new AI security audit rules with six-hour incident reporting, issued the same week.

What is the Crafty Falcon AI hacking campaign?

According to CERT-In, Crafty Falcon “surveys its targets with machine intelligence” and moves money by calling the victims’ own payment and disbursement APIs at machine speed. The agency named four AI-driven offensive security tools in use, at least two of which security researchers have linked to China, Reuters reported.

• ARTEX: an open-source, multi-agent AI penetration testing and command-and-control platform, also linked to recent attacks on South Korean banks.
• PentAGI: an autonomous multi-agent penetration testing system.
• Cairn: an attack search engine.
• CyberStrikeAI: an AI attack framework.

“These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses,” CERT-In said. CERT-In did not say the attacks were state-sponsored, and it did not name the affected companies or the amount stolen.

How the attackers get in

The group used testing and staging environments as entry points, then moved into live production systems through shared credentials, tokens or network paths, as The Indian Express detailed. It reverse-engineered app code to build tailored exploits, sent API calls from modified app packages, and routed traffic through trusted third-party services to look legitimate. Before large transfers, it made test transactions of Re 1.

Attacks were timed around holidays, weekends and the festive season, when monitoring is thin. Firms that patched flaws after CERT-In’s earlier alert of 9 October were deliberately targeted again because the fixes were incomplete.

What CERT-In wants BFSI firms to do

• Run round-the-clock security monitoring, with more staff and lower alert thresholds during holidays and weekends.
• Fully isolate UAT, staging and test environments from production, with no shared credentials, keys or databases.
• Treat client apps as untrusted: validate every transaction on the server, sign API requests and use app attestation.
• Monitor and govern LLM API keys and usage, since LLM traffic from servers may signal a planted attack console.
• Keep crypto wallet keys in hardware security modules or cold custody, with multi-signature withdrawals.

Why it matters for Indian CIOs

The advisory shows autonomous AI agents being turned against Indian finance, not just tested in labs. Earlier this week CERT-In flagged AI agents reading Indian firms’ data undetected, and it has since gained access to Anthropic’s Mythos AI for cyber defence. With attackers now running AI at machine speed, security teams will need AI on defence too, a point echoed by the push for India-made AI security platforms.

Key takeaways

• CERT-In has named “Crafty Falcon” as the group behind AI-driven attacks on Indian NBFCs, fintechs, payment aggregators and crypto exchanges.
• The attackers use four AI tools, ARTEX, PentAGI, Cairn and CyberStrikeAI, and abuse victims’ own payment APIs.
• Firms with incomplete fixes have been hit twice, and CERT-In calls the threat active and ongoing.

FAQ

Who is Crafty Falcon?

Crafty Falcon is the name CERT-In’s finance-sector response team has given to the threat actor behind the AI-driven attacks. CERT-In has not said who is behind it or where it operates.

Which firms are being targeted?

Non-banking financial companies, digital lending platforms, payment aggregators and cryptocurrency exchanges in India.

Featured image: Code on a computer monitor. Photo: Markus Spiske via Wikimedia Commons (CC0)

Be a part of Elets Collaborative Initiatives. Join Us for Upcoming Events and explore business opportunities. Like us on Facebook , connect with us on LinkedIn and follow us on Twitter.

"Exciting news! Elets technomedia is now on WhatsApp Channels Subscribe today by clicking the link and stay updated with the latest insights!" Click here!