CERT-In Alert on AI-Assisted Attacks Targeting Indian Financial Firms

CERT-In issued a critical-severity advisory on 4 November 2026 about an active campaign it calls CRAFTY FALCON. The campaign targets banks and other financial organisations, including NBFCs, fintech firms, payment providers and cryptocurrency platforms. CERT-In says attackers use AI-assisted tools to speed up their operations and exploit payment and disbursement APIs to make unauthorised transfers.

The advisory describes attackers entering through internet-exposed test or staging systems, then moving into live environments when credentials or network access are shared. It also warns that organisations have been targeted again after incomplete fixes, sometimes during weekends and holidays when monitoring may be reduced. The advisory does not publicly identify every affected organisation or state total losses.

For financial firms, the alert underscores the need to separate test and production systems, avoid shared credentials, secure exposed applications and payment APIs, and apply transaction limits. Organisations should also monitor activity during low-staffing periods and investigate unusual small transfers that may precede larger ones.

Customers can switch on transaction alerts, review account activity and contact their bank immediately about an unfamiliar debit. Never share OTPs or PINs, or lend an account for a commission. If you suspect cyber fraud in India, call 1930 promptly or report it at cybercrime.gov.in.

For people who use online banking and payments, NPAV’s Total Security Fraud Protector includes features such as safe banking, anti-keylogger protection and email protection. It can support device-level security, while financial organisations still need to secure their own payment systems and APIs.