Crafty Falcon: CERT-In Warns Fintechs of AI-Driven Payment API Attacks

The Crafty Falcon campaign is an AI-assisted hacking operation that CERT-In says is actively targeting Indian NBFCs, fintechs, payment aggregators and crypto exchanges to move money out through their own payment APIs. In advisory CIAD-2026-0058, issued on 4 November 2026 and rated Critical, CERT-In tells every BFSI entity to treat it as an immediate and continuing threat. The fix is not one patch: it is tighter cloud permissions, isolated test servers, server-side checks on every transaction and 24×7 monitoring, especially on weekends and holidays.

Quick summary

• Advisory: CERT-In CIAD-2026-0058, severity Critical, issued 4 November 2026 (page updated 5 November).
• Who is targeted: NBFCs, digital lending platforms, fintechs, payment aggregators, payment service providers, crypto exchanges and other virtual digital asset (VDA) service providers.
• What is new: it escalates CIAD-2026-0046 (9 October 2026), which warned about abuse of payment and disbursement APIs. CERT-In’s CSIRT-Fin now attributes the campaign to a threat actor it calls “Crafty Falcon”.
• Why it matters: some firms that had already fixed the October issues were hit again because the fixes were incomplete, and attacks were timed for holidays and weekends.
• What to do: follow the checklist below, and report incidents to incident@cert-in.org.in.

What is the Crafty Falcon campaign?

Crafty Falcon is the name CERT-In uses for a threat actor that uses machine intelligence to survey targets and then calls the victim’s own payment APIs to transfer funds. Because the requests come from the victim’s trusted systems, they can slip past the usual checks.

CERT-In says the actor reportedly uses publicly available AI-driven offensive tools, naming the ARTEX family, PentAGI, Cairn and CyberStrikeAI. It also generates many tailored scripts and refines them in quick succession, which means attacks can change faster than a manual security team usually reacts.

Also read: iCloud Public Links: Apple Will Check Shared Files in iOS 27.3

The October advisory, CIAD-2026-0046, had already described how attackers stole payment-gateway and partner-bank API credentials and then sent transfers with dummy reference numbers to mule accounts at several banks, skipping checks such as KYC, beneficiary verification and per-transaction limits. If your team fixed only the items from that advisory, the November update is a signal to check again. For a broader look at agent-style threats, read our guide to AI agent security after CERT-In’s earlier advisory.

How the Crafty Falcon attacks work

The advisory lists the techniques CERT-In has observed. The table below groups them by stage so teams can map each one to an owner.

Stage	Technique observed by CERT-In	Main control to check
Entry	Internet-exposed UAT, staging or test environments	Remove internet exposure; isolate non-production
Entry	Fast exploitation of new file-upload and deserialization flaws in PHP and Node.js apps, leading to web shells	Rapid patching SLA; WAF virtual patching
Movement	Lateral movement from test to production using shared credentials or network paths	No shared credentials or routes between environments
Cloud abuse	Running commands and deploying files through cloud management and serverless services such as AWS Systems Manager and Lambda	Restrict these services to approved principals; alert on use
App abuse	Reverse-engineered client apps rebuilt to make unauthorised API calls	Treat apps as untrusted; request signing and app attestation
Network	Bypassing IP allow-lists by routing through whitelisted third-party “fetcher” IP pools	Mutual TLS, signed requests or scoped API keys
Fraud	₹1 test transactions before large transfers; abuse of merchant settlement APIs	Flag micro-value tests to new beneficiaries; maker-checker on settlements
Crypto	Theft of wallet keys and siphoning of funds from exchanges and VDA providers	HSM or cold custody; multi-signature withdrawals

The PHP point deserves attention if you run any PHP application: our guide on how to update your PHP version covers the patching basics.

Crafty Falcon checklist: what BFSI teams should do now

CERT-In’s recommendations are long. These are the steps we would put at the top of the list for a small or mid-sized fintech team this week, in the order they reduce risk fastest.

1. Staff up monitoring for weekends and holidays. CERT-In asks for 24×7 monitoring with more people and lower alert thresholds during low-monitoring periods.
2. Cut off test environments. Take UAT and staging off the public internet, and make sure they share no credentials or network paths with production.
3. Lock down cloud control planes. Limit cloud management and serverless execution to approved accounts, enforce metadata service protection and least-privilege roles, and alert on high-risk audit-log events.
4. Validate every transaction on the server. Treat the mobile or web app as untrusted, sign API requests with nonces and timestamps, and use app attestation and certificate pinning.
5. Replace shared IP allow-lists. Where you trust a third party’s shared fetcher IP pool, move to mutual TLS, signed requests or scoped API keys.
6. Add fraud rules for the ₹1 pattern. Hold or review micro-value transfers to new beneficiaries that are followed by high-value transfers, and add cooling periods and velocity limits.
7. Clean up secrets. Remove hardcoded credentials, scan code repositories and CI/CD pipelines for secrets, and use short-lived tokens.
8. Watch for web shells. Make deployment folders read-only for the runtime user and use file-integrity monitoring on web roots and temp folders.
9. Assume persistence after any incident. CERT-In warns that re-targeting followed incomplete fixes, so do full eradication with forensic verification and keep hunting afterwards.
10. Control AI and offensive tools in-house. Block unauthorised offensive security tools, watch for AI coding agents running with permission checks disabled, and monitor LLM API calls from servers.

If your business needs outside help to set up monitoring, endpoint protection or a security review, Suprams’ cybersecurity services page explains the options.

Extra steps for crypto exchanges and VDA providers

CERT-In specifically notes theft of crypto wallet keys. Its advice is to keep wallet keys in hardware security modules (HSMs) or cold custody, require multi-signature approval for withdrawals and rotate keys immediately after any suspected compromise. Our post on the Binance hack and exchange security explains why hot-wallet controls matter.

What customers of fintech apps can do

The advisory is aimed at companies, not individual users, and it does not say customer accounts were directly breached. Still, a few habits limit the damage if any service you use is attacked:

• Keep SMS and email alerts on for every bank, wallet, lending and crypto account.
• Install apps only from the official Play Store or App Store, never as APK files shared on chat apps, since CERT-In says attackers rebuild modified app packages.
• If you see a transfer you did not make, call the national cyber fraud helpline 1930 or report at cybercrime.gov.in as soon as possible, and inform your bank.
• Use a strong, unique password and app-based two-factor login on crypto accounts. Our guide to securing a crypto exchange account in India has the steps.

How to report a Crafty Falcon incident

CERT-In asks entities to report suspicious activity to CERT-In/CSIRT-Fin at incident@cert-in.org.in with relevant logs, and to report fraudulent transactions in bulk through the I4C Cyber Fraud Mitigation Centre (CFCFRMS) portal. On detection, isolate affected hosts, preserve evidence and rotate all credentials.

CERT-In says a restricted, more detailed version with indicators of compromise and detection rules has been shared with BFSI entities, but it also warns that indicators may change, so defences should not depend only on blocking them.

Frequently asked questions

What is Crafty Falcon?

Crafty Falcon is CERT-In’s name for an AI-assisted threat actor targeting Indian BFSI entities. It abuses victims’ own payment and settlement APIs to move money, according to advisory CIAD-2026-0058.

Which companies does the CERT-In advisory cover?

It covers NBFCs, digital lending platforms, fintech firms, payment aggregators, payment service providers, crypto exchanges and VDA service providers.

Which AI tools does CERT-In say the attackers use?

CERT-In says the actor reportedly uses public AI-driven offensive tools, including the ARTEX family, PentAGI, Cairn and CyberStrikeAI.

Is my bank or UPI account at risk?

The advisory targets company systems and does not report direct breaches of customer accounts. Keep transaction alerts on and report any unknown debit to 1930 or cybercrime.gov.in quickly.

Bottom line

Crafty Falcon shows how AI tools shorten the gap between a small weakness and a large loss. Fintech and NBFC teams should re-check the October fixes, close test environments, validate every payment on the server and keep someone watching on weekends. Customers should keep alerts on and report unknown debits fast.

Sources

• CERT-In Advisory CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor “Crafty Falcon”
• CERT-In Advisory CIAD-2026-0046: Threat Actors Exploiting Payment and Disbursement APIs
• National Cyber Crime Reporting Portal (Government of India)

About The Author