India's cybersecurity agency CERT-In has issued a Critical-rated warning about an organised, AI-assisted hacker group designated CRAFTY FALCON, saying the threat against the country's financial firms is active and ongoing, Elets BFSI reported on November 5.

Source: Elets BFSI

The advisory, CIAD-2026-0058, was issued on November 4. Transclew, which read both the November advisory and the October 9 advisory it updates, reported that CERT-In's finance-sector response team, CSIRT-Fin, still receives reports of successful attacks, including from non-banking financial companies (NBFCs) and fintech firms that had already been sent earlier restricted advisories and had undertaken remediation.

Source: Transclew

The targets listed are NBFCs, digital lending apps, payment aggregators, payment service providers and cryptocurrency exchanges and virtual digital asset service providers. Neither advisory names a victim firm or a customer, and neither discloses how much was taken. The full indicators of compromise have been shared with financial institutions only in a restricted version of the warning.

How the money leaves

According to the advisories, the attackers abuse the victims' own payment application programming interfaces (APIs) — the connections a firm's app uses to ask its systems to pay out. Before moving large sums, they send micro-value test transactions, such as Rs 1, to check that a route works; the October advisory said the money then went to mule accounts across multiple banks over IMPS and NEFT and was withdrawn at once, with logs deleted afterwards.

Transclew reported that entry came in part through test (UAT or staging) servers left reachable from the internet, with attackers then moving to live systems using shared credentials, tokens or network paths, and through stolen payment-gateway keys and modified copies of firms' own apps that defeated controls assuming only the legitimate app would call the APIs. On crypto platforms, the group has stolen wallet keys and drained funds from exchange wallets, Elets BFSI reported.

Where the AI comes in

CERT-In names four publicly available tools in the attack chain: the ARTEX family, PentAGI, the Cairn attack search engine and the CyberStrikeAI framework. Elets BFSI reported that PentAGI and CyberStrikeAI can run full attack sequences autonomously and adjust as targets respond; Transclew noted the advisory's point that such penetration-testing tools do not themselves validate authorisation, and that what they add is speed — whole attack chains run at machine speed. BeInCrypto also reported the Critical rating, the Rs 1 test payments and the stolen wallet keys.

Source: BeInCrypto

CERT-In says firms were attacked again after incomplete remediation, and that attacks were timed to coincide with holidays, weekends and other low-monitoring windows to delay detection and response.

What CERT-In is asking firms to do

Store crypto wallet keys in hardware security modules or cold custody and require multi-signature approval for withdrawals; introduce cooling periods for newly added beneficiaries across payment systems; verify every transaction on the firm's own servers and sign each request so a modified app can be caught; flag a Rs 1 payment to a new payee followed by a large one and hold or review such flows; and increase monitoring staff and lower alert thresholds during holidays and weekends. The advisory does not say whether customers' own accounts were touched — the transfers it describes ran through firms' own payout and settlement systems.

What happens next depends in part on disclosure: CERT-In has restricted the full technical indicators to financial-sector participants, so any public figure for total losses would have to come from affected exchanges or lenders announcing them themselves.