India's cybersecurity agency, CERT-In, has issued a critical warning about hackers using artificial intelligence tools to target the country's financial sector. The cybercriminal group, identified as "Crafty Falcon", reportedly operates at machine speed and exploits organisations' own payment systems to carry out unauthorised financial transactions.
According to CERT-In, the campaign remains active and has affected several types of financial institutions, including non-banking financial companies (NBFCs), digital lending platforms, fintech companies, payment aggregators, payment service providers, cryptocurrency exchanges and virtual digital asset service providers.
"The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation," the agency stated in its advisory.
CSIRT-Fin is the financial sector-focused cybersecurity response team operating under CERT-In.
The agency revealed that some organisations had been attacked again because they failed to completely address the security weaknesses that initially exposed their systems. The hackers are also reportedly scheduling attacks during weekends and holidays, when cybersecurity monitoring and staffing levels are generally lower.
However, CERT-In has not identified the organisations affected by these attacks or disclosed the financial losses associated with the campaign.
AI tools used to hack financial institutions
According to CERT-In, the Crafty Falcon group is deploying several publicly available AI-powered offensive security tools, including ARTEX, PentAGI, Cairn and CyberStrikeAI.
These systems can reportedly execute entire cyberattack sequences autonomously. They can also modify their approach based on how targeted systems respond, allowing attacks to continue with limited human intervention.
The supporting infrastructure frequently changes its IP addresses within hours or days, making it more difficult for financial institutions to identify and block malicious activity.
The advisory also highlighted attacks targeting cloud infrastructure and management services, including AWS Systems Manager and Lambda. Hackers reportedly exploited these channels to introduce malicious files into targeted environments.
In certain incidents, attackers reverse-engineered application code to develop customised exploits. They also modified application packages to make unauthorised API requests.
Hackers use Re 1 transactions to test payment systems
One of the more concerning tactics identified by CERT-In involves hackers using small-value transactions to test whether they can manipulate financial systems.
In some cases, attackers reportedly initiated transactions as small as Re 1 to check whether unauthorised money transfers could be completed before attempting larger payments.
The group also exploited merchant settlement APIs, while cryptocurrency platforms were targeted to obtain wallet keys.
CERT-In further explained that hackers were using internet-exposed environments, including testing and staging systems, as entry points into organisations' networks.
After gaining initial access, they reportedly moved into production systems by exploiting shared credentials, authentication tokens and network connections.
The campaign also involved exploiting recently disclosed vulnerabilities in PHP and Node.js, which had already raised cybersecurity concerns globally.
CERT-In advises financial institutions to strengthen security
With the attacks continuing, CERT-In has urged financial institutions to improve their cybersecurity preparedness and maintain continuous monitoring of their networks.
Among the key recommendations are:
Maintaining round-the-clock security monitoring and increasing cybersecurity staffing.
Strengthening access controls for cloud management platforms and internet-facing systems.
Closely tracking Re 1 and other micro-value transactions, particularly when followed by larger transfers.
Introducing cooling-off periods before allowing payments to newly added beneficiaries.
Monitoring unauthorised AI-powered security tools and API usage involving large language models.
Operating under the assumption that attackers may already have gained access to internal networks.
The agency has also emphasised the importance of identifying suspicious activity before hackers can move from testing environments into critical production systems.
CERT-In steps up AI-powered cybersecurity efforts
The latest warning comes shortly after CERT-In disclosed that rogue AI agents had gained unauthorised access to confidential information and systems belonging to select Indian organisations.
There have also been reports of cyberattacks involving Indian financial institutions, including State Bank of India (SBI) and AU Small Finance Bank, raising concerns about the security of customer information and banking infrastructure.
Meanwhile, CERT-In is reportedly strengthening its own cybersecurity capabilities. The agency has reportedly gained access to Anthropic's advanced cybersecurity model, Claude Mythos, to help identify and assess software vulnerabilities.
Cybersecurity threats have also increased internationally, with vulnerabilities involving PHP, Node.js and weak eMudhra security keys putting organisations on alert last month.
The series of incidents has been described as "Black October", highlighting how increasingly capable AI systems are exposing weaknesses in digital infrastructure. While these developments could help security researchers identify and fix vulnerabilities, they also give cybercriminals more powerful tools to automate attacks and target financial systems.
