CERT-In warns banks, fintechs of AI-driven 'Crafty Falcon' cyberattacks

India's national cyber security agency, the Indian Computer Emergency Response Team (CERT-In), has issued a critical advisory warning banks, non-banking finance companies (NBFCs), fintech firms, payment aggregators and cryptocurrency exchanges of an escalating campaign of AI-assisted cyberattacks. The advisory, dated Wednesday, 4 November 2026, names the threat actor "CRAFTY FALCON" and updates an earlier alert issued on 9 October. CERT-In said the threat remains active and that successful intrusions are still being reported, including at some organisations that had already acted on the earlier warning.

This advisory is about money moving through the plumbing of Indian digital finance. An API, or application programming interface, is the channel through which one computer system talks to another: when a lending app sends a loan to your bank account, or a payment company settles money with a shop, it happens through APIs. If attackers can misuse those channels, they can trigger transfers that look like normal business, which makes them harder to spot.

The new element is speed. Attack and testing tools built on large language models, the technology behind chatbots, can scan systems, write code and try many approaches far faster than a human team. Security teams use similar tools to test their own defences, which is why CERT-In asks firms to restrict unauthorised AI-driven tools on their systems and watch how LLM services are being used inside their networks. The advisory's warning that attacks continued even at organisations that had acted on the October alert suggests the attackers are adapting.

For fintech start-ups, the advisory is a direct test. Many young companies in lending, payments and crypto connect to banks and payment networks through APIs, and their security teams are often small. A breach can mean direct losses, trouble with regulators and lost customer trust. CERT-In shared a restricted version of the advisory, with technical indicators, with financial entities, so the public text is limited.

For ordinary users, the advisory does not report any breach of a named company or customer data. The practical steps remain the usual ones: use only official apps from official app stores, do not install modified versions of banking or payment apps, and report any transaction you did not make to your bank at once.

Peepals timeline: on 9 October 2026, CERT-In issued its first alert on the campaign to the financial sector. On 4 November 2026, it issued an updated critical advisory naming the threat actor CRAFTY FALCON, saying the threat was still active and that intrusions continued even at some organisations that had acted on the first alert. Reports on the advisory followed on 5 November.

Short-term: banks, NBFCs, fintechs, payment aggregators and crypto exchanges will need to review API security, check for misuse of AI tools on their systems and report suspicious activity to CERT-In.

Long-term: the advisory adds pressure on financial firms, especially smaller fintechs, to invest in faster detection, since AI-assisted attacks can move quickly from finding a weakness to moving money.

Who is affected: security and technology teams at Indian financial firms, fintech start-ups that rely on payment and lending APIs, crypto exchanges, regulators and, indirectly, customers whose money flows through these systems.

Questions and Answers