The Indian Computer Emergency Response Team (Cert-In), which deals with cyber security incidents, has warned banks, non-banking financial companies (NBFCs) and fintech firms about a campaign of AI-driven cyberattacks that has led to unauthorised fund transfers worth crores. In two advisories issued on November 3 and 4, Cert-In and the Indian Cyber Crime Coordination Centre (I4C) flagged attacks in which hackers are using AI agents to break into financial institutions’ systems and exploit payment and fund-disbursement platforms to transfer money without authorisation.
They then target automated fund-disbursement systems and application programming interfaces (APIs), which are used to process payments and transfers. The November 3 advisory, issued by I4C’s National Cybercrime Threat Analysis Unit (NCTAU) along with Cert-In, said attackers were exploiting unpatched software and incorrectly configured internet-facing servers to gain access to financial institutions’ systems.
The agency said its analysis of incidents reported by NBFCs, digital lending platforms, fintech companies, payment aggregators, payment service providers and cryptocurrency exchanges showed that attackers were using publicly available AI-based offensive security tools to carry out attacks at high speed.
The November 4 advisory, issued by Cert-In’s Computer Security Incident Response Team-Finance (CSIRT-Fin), described a further escalation of the campaign and identified the threat actor as “CRAFTY FALCON”. The incidents came to light through voluntary disclosures by AI model providers, OpenAI and Anthropic, a government official said.
