India’s cybersecurity agency has warned financial institutions about an active hacking campaign involving artificial intelligence tools, as cybercriminals increasingly use automated technologies to target banks, fintech companies and cryptocurrency platforms.
The Indian Computer Emergency Response Team (CERT-In) has identified a hacking group known as ‘Crafty Falcon’ behind a series of attacks targeting non-banking financial companies (NBFCs), digital lending platforms, fintech businesses and cryptocurrency exchanges. According to an advisory issued on Wednesday, the attackers are using publicly available AI-powered tools to automate cyber intrusions and exploit vulnerabilities in financial systems.
CERT-In identified four tools associated with the campaign: ARTEX, PentAGI, Cairn and CyberStrikeAI. Security researchers have linked at least two of these tools to China. However, the agency has not identified the individuals or organisation responsible for the attacks and has not attributed the campaign to any government.
The agency warned that attackers use machine intelligence to identify vulnerable systems and carry out intrusions at high speed. Their activities reportedly include exploiting payment and fund-disbursement APIs, which allow banks, lenders and fintech platforms to communicate and process financial transactions.
Another concern is the timing of these attacks. According to CERT-In, the hackers have targeted organisations during weekends, public holidays and other periods when monitoring teams may be less active, potentially delaying the detection of suspicious activities.
The warning follows several cybersecurity incidents involving Indian financial institutions. Reuters previously reported that two Mumbai-based non-bank lenders suffered approximately $2 million in unauthorised instant transfers through accounts linked to ICICI Bank in October. The incident reportedly involved compromised application programming interfaces.
Separately, State Bank of India disclosed a dark-web leak involving 3,897 customer records. Spandana Sphoorty Financial also reported unauthorised bank-account debits, while AU Small Finance Bank said it was investigating a possible customer-data leak. CERT-In has not confirmed whether these incidents were connected to the Crafty Falcon campaign.
The agency also highlighted that some organisations had been targeted again despite receiving earlier warnings and attempting to fix security weaknesses.
The development underlines the growing risks associated with AI-assisted cybercrime. As India’s digital financial ecosystem expands, strengthening API security, monitoring suspicious transactions and implementing effective cybersecurity measures will remain essential for protecting financial institutions and their customers.
