CERT-In names Crafty Falcon as the AI actor hitting Indian fintech payment APIs

On 4 November 2026, the Indian Computer Emergency Response Team issued a critical advisory naming Crafty Falcon as an AI-assisted financial threat actor that surveys targets with machine intelligence and strikes by invoking victims' own payment and disbursement APIs. The Indian Express, Business Standard (Reuters) and Economic Times (PTI) all report the same designation from CSIRT-Fin under CERT-In, and say the campaign remains active against NBFCs, digital lending platforms, fintechs, payment aggregators, payment service providers and cryptocurrency or virtual digital asset desks.

According to those accounts of the advisory, attackers use publicly available AI offensive tools including ARTEX, PentAGI, Cairn and CyberStrikeAI to run full attack chains at machine speed. Entry often starts in internet-exposed test or staging environments, then moves into production through shared credentials or network paths. Actors reverse-engineer application packages to call APIs that defenders assumed only legitimate clients would touch, route traffic through trusted third-party fetcher IPs, abuse cloud management services, and validate pipes with micro transfers such as Rs 1 before larger mule payouts. Crypto targets are hit for wallet keys.

CERT-In said firms that received an earlier 9 October restricted advisory and only partly remediated were deliberately re-attacked, often over holidays and weekends when monitoring is thin. Defenders are told to keep 24x7 coverage, separate non-production from production, treat client apps as untrusted, watch Rs 1-then-large patterns, and harden wallet custody. The named-actor update sits beside the broader I4C warning on agentic payment fraud, and it sharpens the operational checklist for anyone running UPI, lending disbursement or merchant settlement rails in India.