Because the calls come from the victim’s own allow-listed infrastructure, the October advisory says they bypass KYC, beneficiary verification, balance and per-transaction limit checks. To the payment partner, the fraud looks like normal traffic.
Also read: Addressing Deepfake Risks in BFSI: Why Early Detection Is Critical
The real story: AI took away the grace period
Is “AI-driven” doing too much work here? Partly. Hardcoded tokens, plaintext credentials and missing MFA were in the October advisory before the AI tools took center stage.
What the tooling changes is cost and tempo. CERT-In says the frameworks run full attack chains on their own, refine tailored scripts in rapid succession, adapt payloads to how the target responds and rotate infrastructure within hours. Reverse-engineering one lender’s app used to be a project. Now an agent can work through a target list.
That explains the re-targeting. An agent can come back, test whether the fix was complete and try the next path on a Saturday night. Patching in the next sprint assumes an attacker who gets tired. This one doesn’t.
Who’s exposed
Any Indian entity that can move money through an API: lenders with disbursement APIs, aggregators with settlement APIs, fintechs holding partner-bank credentials and crypto exchanges with hot wallets. You’re most exposed if an internet-facing non-production environment shares anything with production, or if your payment API trusts the client app or a source IP instead of a signed, server-validated request.
What to do this week
CERT-In lists 27 actions. Start with the six that break the money path:
- Cut non-production off from production. No shared credentials, keys, databases or routes, and alert on any UAT-to-production access.
- Stop trusting the client and the source IP. Validate server-side, sign requests with a nonce and timestamp, use app attestation, and swap fetcher IP allow-lists for mutual TLS or scoped keys.
- Retire long-lived secrets. Scan repositories and CI/CD for secrets, move to short-lived scoped tokens and rotate build and deployment tokens now.
- Hold the Rs 1 pattern. Flag micro-value transfers to new beneficiaries followed by large ones, and add cooling periods and maker-checker approval on merchant settlements.
- Watch the cloud control plane. Alert in AWS CloudTrail on Systems Manager sessions and SendCommand, Lambda UpdateFunctionCode in production and new IAM users, roles or keys. Default-deny server egress.
- Staff the weekend and assume persistence. Lower holiday alert thresholds and verify eradication forensically.
What we’re watching
The offensive tools are compromised too, though nothing ties this to CRAFTY FALCON. Researcher Badbyte recently said that a GitHub copy of ARTEX pulled a Docker image with a hidden root shell, and 62 internet-facing consoles served it between Nov. 2 and 4. It’s one more reason CERT-In wants these tools banned from corporate infrastructure.
Sources
CERT-In, Advisory CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor “CRAFTY FALCON”, Nov. 4, 2026
The Hacker News, CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access, Nov. 5, 2026 (summary of CIAD-2026-0046 and Badbyte’s ARTEX research)
Business Standard, China-linked tools used in AI-driven cyberattacks on Indian financial firms, Nov. 5, 2026 Cloud Security Alliance, Crafty Falcon: Weaponized Pentest Agents Hit the Financial Sector, Nov. 5, 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-11
CERT-In’s critical advisory, last week, gives a name to the campaign draining Indian fintechs: CRAFTY FALCON, an “AI-assisted financial threat actor” that moves money by calling its victims’ own payment and disbursement APIs. Organizations that fixed their systems after CERT-In’s first warning in October have been hit again.
The AI label will get the headlines. The attack chain tells a plainer story. Hardcoded API tokens, staging servers that share credentials with production, IP allow-lists that trust shared third-party fetchers: none of these weaknesses is new. What the AI tooling changes is the time between an attacker finding one and cashing it out, and that time is now shorter than most remediation cycles.
What CERT-In has confirmed
The latest advisory updates the previous Oct. 9 advisory. CERT-In’s finance team, CSIRT-Fin, named the actor and called the campaign active and ongoing, with victims across NBFCs, digital lenders, fintechs, payment aggregators, payment service providers and crypto exchanges.
Entities that had received the earlier restricted advisories and remediated were deliberately hit again, some after incomplete cleanup, with attacks timed for holidays and weekends.
CERT-In names four publicly available offensive AI tools: ARTEX, the PentAGI multi-agent pentest system, the Cairn attack search engine and CyberStrikeAI. It doesn’t attribute the actor or say how many entities were hit. Business Standard reported that researchers link at least two of the tools to China, but where a tool was written says little about who ran it.
How CRAFTY FALCON gets from a staging server to a mule account
The advisories describe four stages:
- Get in. Exposed UAT and staging servers, file-upload and deserialization flaws exploited as soon as they’re public, hardcoded API tokens, forged repository commits, plaintext credentials and services without MFA.
- Reach production. Credentials and network paths shared with production carry the attacker across. AWS Systems Manager and Lambda then run commands through legitimate cloud channels.
- Get past the app. The attacker reverse-engineers the app, calls APIs from a modified package and routes traffic through allow-listed third-party fetcher IPs that anyone can make fetch a URL.
- Test, cash out, clean up. A Rs 1 transfer confirms the route. Large transfers follow to mule accounts at several banks, including through merchant settlement APIs, and crypto platforms lose wallet keys. Logs and endpoint tools get tampered with.
Because the calls come from the victim’s own allow-listed infrastructure, the October advisory says they bypass KYC, beneficiary verification, balance and per-transaction limit checks. To the payment partner, the fraud looks like normal traffic.
Also read: Addressing Deepfake Risks in BFSI: Why Early Detection Is Critical
The real story: AI took away the grace period
Is “AI-driven” doing too much work here? Partly. Hardcoded tokens, plaintext credentials and missing MFA were in the October advisory before the AI tools took center stage.
What the tooling changes is cost and tempo. CERT-In says the frameworks run full attack chains on their own, refine tailored scripts in rapid succession, adapt payloads to how the target responds and rotate infrastructure within hours. Reverse-engineering one lender’s app used to be a project. Now an agent can work through a target list.
That explains the re-targeting. An agent can come back, test whether the fix was complete and try the next path on a Saturday night. Patching in the next sprint assumes an attacker who gets tired. This one doesn’t.
Who’s exposed
Any Indian entity that can move money through an API: lenders with disbursement APIs, aggregators with settlement APIs, fintechs holding partner-bank credentials and crypto exchanges with hot wallets. You’re most exposed if an internet-facing non-production environment shares anything with production, or if your payment API trusts the client app or a source IP instead of a signed, server-validated request.
What to do this week
CERT-In lists 27 actions. Start with the six that break the money path:
- Cut non-production off from production. No shared credentials, keys, databases or routes, and alert on any UAT-to-production access.
- Stop trusting the client and the source IP. Validate server-side, sign requests with a nonce and timestamp, use app attestation, and swap fetcher IP allow-lists for mutual TLS or scoped keys.
- Retire long-lived secrets. Scan repositories and CI/CD for secrets, move to short-lived scoped tokens and rotate build and deployment tokens now.
- Hold the Rs 1 pattern. Flag micro-value transfers to new beneficiaries followed by large ones, and add cooling periods and maker-checker approval on merchant settlements.
- Watch the cloud control plane. Alert in AWS CloudTrail on Systems Manager sessions and SendCommand, Lambda UpdateFunctionCode in production and new IAM users, roles or keys. Default-deny server egress.
- Staff the weekend and assume persistence. Lower holiday alert thresholds and verify eradication forensically.
What we’re watching
The offensive tools are compromised too, though nothing ties this to CRAFTY FALCON. Researcher Badbyte recently said that a GitHub copy of ARTEX pulled a Docker image with a hidden root shell, and 62 internet-facing consoles served it between Nov. 2 and 4. It’s one more reason CERT-In wants these tools banned from corporate infrastructure.
Sources
CERT-In, Advisory CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor “CRAFTY FALCON”, Nov. 4, 2026
The Hacker News, CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access, Nov. 5, 2026 (summary of CIAD-2026-0046 and Badbyte’s ARTEX research)
Business Standard, China-linked tools used in AI-driven cyberattacks on Indian financial firms, Nov. 5, 2026 Cloud Security Alliance, Crafty Falcon: Weaponized Pentest Agents Hit the Financial Sector, Nov. 5, 2026
Disclaimer: The data and content written in this blog is based on on open web information available. Analysts and researchers are advised to confirm once again from original sources.
Source: Cyble Research · 2026-11-11