On November 4, 2026, the Indian Computer Emergency Response Team (CERT-In) issued a critical advisory on the active Crafty Falcon cyberattack campaign targeting Indian financial entities. The AI-assisted campaign seeks unauthorised fund transfers through payment and disbursement Application Programming Interfaces (APIs).
Targets and attack methods
The campaign targets non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment aggregators, payment service providers, banks and cryptocurrency exchanges. Attackers use publicly available AI tools, including ARTEX, PentAGI, Cairn and CyberStrikeAI, to carry out sophisticated, autonomous attacks at machine speed. Methods include exploiting internet-facing testing environments, targeting cloud infrastructure and reverse-engineering application code. Operations are timed for holidays, weekends and other periods of reduced security monitoring.
Ongoing threat and response
CERT-In’s Computer Security Incident Response Team-Finance (CSIRT-Fin) continues to receive reports of successful attacks, including from entities that had previously undertaken remediation. CERT-In and the Indian Cyber Crime Coordination Centre (I4C) have urged financial institutions to maintain round-the-clock monitoring, increase security staffing and lower alert thresholds during low-monitoring periods.
Important Facts for Exams
- API abstraction: An application programming interface exposes selected functions while concealing internal workings, allowing software to interact without relying on implementation details.
- Statutory basis: CERT-In was established under Section 70B of the Information Technology Act, 2000, giving its incident-response role a statutory basis.
- Compromised-system cleanup: Cyber Swachhta Kendra detects compromised systems and notifies users, enabling the cleaning and securing of affected end-user systems.
