CERT-In warns Crafty Falcon is using agentic AI in financial-sector attacks
India's CERT-In says the active Crafty Falcon campaign is using agentic offensive-security tools to accelerate attacks against lenders, fintech companies, payment providers, and cryptocurrency platforms. The agency reports successful and repeat attacks, but has not named the victims, quantified losses, or attributed the operator to a country.
What happened?
Confirmed facts: on November 4, 2026, the Indian Computer Emergency Response Team and its financial-sector incident-response team published critical advisory CIAD-2026-0058 warning that an active campaign designated Crafty Falcon is targeting non-banking financial companies, digital lenders, fintech firms, payment aggregators, payment service providers, cryptocurrency exchanges, and virtual-asset service providers. CERT-In says it continues to receive reports of successful attacks and that some previously warned organizations were targeted again after incomplete remediation. The agency says attackers time activity for holidays, weekends, and other periods of reduced monitoring. Confirmed technical reporting: CERT-In identified publicly available AI-driven offensive-security frameworks in incidents, including ARTEX, PentAGI, Cairn, and CyberStrikeAI. Its October 9 advisory described attackers compromising exposed applications, APIs, and privileged endpoints, stealing payment or bank API credentials, and invoking disbursement or transfer functions from trusted infrastructure. Google Threat Intelligence Group and Mandiant separately reported observing ARTEX, PentAGI, Cairn, and related agentic frameworks conducting real intrusion stages such as reconnaissance, lateral movement, database exploitation, and preparation for exfiltration. Attribution and uncertainty: CERT-In has not publicly identified the people or organization operating Crafty Falcon, named the affected companies, disclosed a victim total, or quantified losses. Reuters reported that independent researchers linked at least two tools to China-related activity, but a tool's origin or previous use does not prove that this campaign is Chinese state-sponsored. Recent unauthorized transfers and data incidents at Indian financial firms provide context, but CERT-In has not confirmed that every one of those cases was part of Crafty Falcon. No public evidence supports treating all AI security tools, all fintech platforms, or every affected firm's customers as compromised.
How the technology works
At a safe defensive level, agentic offensive frameworks combine a language model with scanners, scripting tools, command execution, and multiple specialized software agents. A human operator can provide a target and objective while the system tests many paths, interprets responses, adjusts scripts, and continues parts of an intrusion much faster than a person working step by step. The underlying weaknesses remain familiar: internet-exposed applications, unpatched middleware, deprecated or unauthenticated APIs, unrestricted file uploads, static tokens embedded in code, plaintext credentials, weak remote access, and missing multifactor authentication. After entry, attackers may use legitimate application or payment APIs from an already trusted server, which can make fraudulent activity look like normal internal traffic. This campaign therefore is not evidence of an all-powerful AI that bypasses every defense. It shows how automation can discover and chain ordinary security failures at machine speed, shortening the time between initial access and financial impact. Defenders should not download or test the named offensive frameworks on production systems. This article omits exploit commands, infrastructure indicators from restricted advisories, credential-abuse procedures, and operational instructions that could facilitate unauthorized access.
Who is affected?
The immediate risk is highest for Indian banking and financial-services organizations, especially non-bank lenders, digital lending platforms, fintech firms, payment aggregators, payment service providers, wallet operators, and cryptocurrency or virtual-asset services. Their partner banks, cloud providers, software vendors, and customers may also face downstream risk when compromised API credentials can initiate transfers or expose financial and identity data. Successful abuse may cause unauthorized disbursements, theft, service interruption, account manipulation, data exposure, regulatory obligations, and difficult recovery across multiple connected institutions. Small security teams are particularly exposed during weekends and holidays because high-speed automation can compress investigation and response time. Customers should not assume their account was compromised solely because they use an Indian financial service; CERT-In has not published a victim list. However, people should treat unexpected payout, loan, wallet, identity-verification, or account-recovery messages with caution because public attention around the campaign can also be exploited by phishers and recovery scammers.
What should you do?
Financial institutions should treat this as an active incident-response priority, not a future AI-policy exercise. Inventory every public application, API, administrative interface, integration, service account, source repository, and payment or disbursement credential. Remove deprecated endpoints and unnecessary internet exposure; patch supported middleware; block unrestricted uploads; enforce phishing-resistant multifactor authentication; replace long-lived static tokens with short-lived identities; store secrets in a managed vault or hardware security module; and restrict production-server outbound traffic. Require maker-checker or second-person approval for fund movement, validate every payout against an approved business record, enforce transaction and daily limits at the payment layer, verify new beneficiaries, and place unusual transfers on hold. Monitor sequences rather than isolated alerts: a new authentication source followed by permission probing, rapid script creation, API enumeration, new-beneficiary activity, or bulk transfer attempts should trigger immediate review. Maintain centralized, tamper-resistant logs for identity, application, API, cloud control plane, database, network, and endpoint activity; CERT-In recommends at least 180 days of retention for relevant security logs. Deploy canary credentials and decoy administrative assets to expose exhaustive automated probing. If suspicious activity appears, suspend affected APIs, isolate hosts, preserve evidence, rotate credentials and sessions, reconcile transactions independently, retest the complete environment after remediation, and report the incident to the relevant authorities. Customers should use unique passwords, enable strong multifactor authentication, monitor account and wallet activity, confirm alerts through the provider's official app or phone number, and promptly report unauthorized transfers without engaging anyone offering paid recovery through social media.
My analysis
My Analysis - opinion and inference: Crafty Falcon matters because it turns a familiar security problem into a timing problem. Organizations that once had days to notice scanning or credential abuse may now have hours or minutes before automation reaches a payment system. My inference is that the defenders most likely to suffer repeat losses are not necessarily those with the weakest single product, but those that patch one visible flaw while leaving the same credentials, trust relationships, egress paths, or business-process bypasses intact. CERT-In's report of repeat attacks after incomplete remediation supports that risk assessment, but it does not reveal the full forensic chain for every victim. From a privacy-first viewpoint, the answer cannot be unlimited employee surveillance or permanent retention of every customer's behavior. Financial firms should collect precise security telemetry around privileged identities, APIs, transfers, and administrative changes; protect it from internal misuse; retain it for a defined defensive purpose; and delete routine data when that purpose expires. Customers deserve specific notice when their identity or transaction data may have been exposed, not vague reassurance based on the absence of public evidence. AI changes attack speed and scale, but responsibility remains human: vendors must ship safer defaults, executives must fund complete remediation, and institutions must build payment controls that remain effective even after an application server is compromised. The correct response is faster, narrower, and more accountable defense, not panic about every AI tool or unsupported claims about who is behind the campaign.
Why this matters
Cyber incidents often sound distant or overly technical. The important question is whether the same weakness, behavior, surveillance power, or exposure exists in systems you use. Facts and opinion are separated here so you can judge both clearly.
Facts, claims, and unknowns are separated above. Details may change as investigations and official statements develop.
CERT-In advisory CIAD-2026-0058: Crafty Falcon escalation and defensive actions CERT-In advisory CIAD-2026-0046: payment and disbursement API attacks CERT-In advisory CIAD-2026-0049: AI agents as attack vectors Google Threat Intelligence Group: ARTEX and agentic offensive frameworks in real intrusions Reuters: India warns of AI-assisted attacks against financial firms CERT-In 2026 advisory index