CERT-In: AI-Assisted 'Crafty Falcon' Is Hitting Indian Banks, Fintechs and Crypto Exchanges With ARTEX and PentAGI, Testing Thefts With ₹1 Transfers
CERT-In warns that the AI-assisted threat actor Crafty Falcon is still breaking into Indian BFSI firms with public AI attack tools and sending fraudulent payouts from victims' own allow-listed systems.
India's national cyber agency has warned that an AI-assisted threat actor it calls Crafty Falcon is still attacking banks, fintechs and crypto platforms, and getting faster. CERT-In says the group uses publicly available AI offensive tools to break into payment systems and then sends fraudulent fund transfers from the victims' own trusted infrastructure, often after a ₹1 test transfer.
What Happened
On 4 November 2026, CERT-In's financial-sector unit, CSIRT-Fin, issued an advisory titled "Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON." It updates an advisory from 9 October 2026, which first warned NBFCs, digital lending platforms, fintechs, payment service providers and wallet operators about the campaign.
The new advisory says the activity is active and evolving. Victims have been attacked again after incomplete remediation, including on weekends and public holidays. The time between first compromise and fraudulent transfers has also shrunk. The attacks now reach cryptocurrency exchanges and digital asset service providers, where keys and funds have been stolen.
CERT-In uses Crafty Falcon as a tracking name for the activity. It has not said who is behind it, and the public advisory gives no count of victims or total losses.
Technical Details
According to CERT-In, the operators use publicly available AI-driven offensive tools, naming ARTEX, PentAGI, the Cairn search engine and CyberStrikeAI. The agency says such tools "execute complete attack chains autonomously at machine speed."
Initial access methods listed in the advisory include:
- Stolen long-lived, static or hard-coded API tokens.
- Forged commits in source code repositories.
- Plaintext credentials in configuration files, source code or databases.
- Applications and remote services without multi-factor authentication.
- Internet-facing applications and exposed APIs, used to steal payment gateway and partner-bank API credentials.
After getting in, the operators:
- Reverse-engineer application code to build tailored exploits, and call APIs using modified app packages. This defeats controls that assumed only the genuine mobile app would ever call those APIs.
- Abuse AWS Systems Manager and Lambda to run commands and deploy payloads.
- Move from staging to production through internet-exposed test environments that share credentials, tokens and network paths.
- Bypass IP allow-lists by routing traffic through shared third-party fetcher IP pools.
- Exploit new flaws in PHP and Node.js applications, especially file-upload and deserialization chains that end in web shells.
- Send a ₹1 test transfer to confirm a fund flow works, then move large sums to mule accounts across several banks.
- Delete logs, tamper with EDR and clean up forensic traces.
Because the transfers come from the victim's own allow-listed systems, CERT-In says they get past KYC, sanctions screening, beneficiary verification, balance checks and per-transaction limits.
Who Is Affected
The advisory is aimed at Indian banking, financial services and insurance (BFSI) organisations, especially NBFCs, digital lenders, payment aggregators, fintechs, wallet operators and crypto exchanges. Any organisation that exposes payment or disbursement APIs, keeps static API keys in code, or runs internet-facing staging environments matches the targeting pattern.
The ARTEX Supply-Chain Twist
ARTEX, one of the tools CERT-In names, has its own problem this week. After its developer took the original repository down, copies spread on GitHub and Docker Hub. An independent researcher found that a popular GitHub copy pulled a Docker Hub image with a hidden backdoor in the login handler. If the CAPTCHA field starts with a secret marker, the rest is run as a root shell command before any credential check. Docker Hub shows about 9,000 pulls of that image. The researcher counted 62 internet-facing ARTEX consoles running the backdoored build between 2 and 4 November, out of 1,645 exposed consoles. Nothing links Crafty Falcon to the backdoored builds, but the episode shows that people running pirated AI attack tools can be compromised themselves.
What To Do Now
CERT-In's recommendations include:
- Run 24×7 security monitoring, with extra staff on weekends and holidays, and do a forensic sweep after any incident to confirm the attacker is gone.
- Isolate test and staging from production, remove shared credentials, and monitor cloud audit logs in real time.
- Validate transactions server-side, sign API requests, and use app attestation and certificate pinning.
- Patch internet-facing apps quickly, prioritising file-upload and deserialization flaws in PHP and Node.js.
- Add payment controls: alert on micro-value transactions followed by large transfers, apply cooling periods for new beneficiaries, require maker-checker approval for merchant settlements and multi-signature approval for crypto withdrawals.
- Report suspicious activity to CERT-In and CSIRT-Fin.
Other steps follow from the initial access list: replace static API tokens with short-lived credentials, scan repositories for secrets, require signed commits, and enforce MFA on every remote service.
For AWS environments, a starting point is to review who has been running commands through Systems Manager:
# Recent SSM SendCommand calls (review who, from where, and against which instances)
aws cloudtrail lookup-events \
--lookup-attributes AttributeKey=EventName,AttributeValue=SendCommand \
--max-results 50 --query 'Events[].{time:EventTime,user:Username}'Why It Matters
The advisory describes a financially motivated campaign built around off-the-shelf AI attack frameworks, focused on fraud, not espionage. The techniques are not new. Leaked tokens, exposed staging servers and trusted API callers have been abused for years. What CERT-In describes is the speed: AI tools let one operator find and chain these weaknesses fast enough that weekend gaps and half-finished remediation are enough.
For defenders, the lesson is that controls that assume "requests from our own servers are legitimate" are no longer safe. Payment controls need to check what a transaction does, not just where it comes from.
