CERT-In, India's national cyber emergency team, issued an advisory on 4 November 2026 rated Critical. It says an AI-assisted group, which it calls Crafty Falcon, is attacking Indian finance firms. Targets include non-bank lenders, fintech firms, payment companies and crypto exchanges. CERT-In said the group uses public AI hacking tools: ARTEX, PentAGI, Cairn and CyberStrikeAI. The attackers trigger the victim's own payment and disbursement APIs to move money. The Hacker News reported that ARTEX's developer pulled its GitHub repository after real-world misuse, and copies then appeared.
CERT-In said some firms were hit again after only partly fixing earlier breaches. It also said attacks were timed for holidays and weekends, when staff watch less closely. The attackers' network addresses change within hours to days. The public advisory does not say how many firms were hit or how much money was lost. The full indicators and detection rules went only to finance firms in a restricted version.
CERT-In says attackers entered through test and staging systems, then reached production with shared credentials. They also altered apps to call APIs that trusted only the real app. Teams that run payment systems can check their own test-to-production separation. They can also check whether the server validates every transaction itself, as CERT-In advises.