CERT-In Warns of 'Crafty Falcon' AI Attacks on Indian Fintechs

Re-targeting after incomplete fixes

The advisory builds on a warning from October 9, which described attackers exploiting flaws in internet-facing applications, exposed APIs and stolen credentials to push fraudulent transactions to mule accounts across several banks. According to CERT-In, firms patched the problems but were "deliberately re-targeted" because remediation was incomplete. The attackers also appear to have timed the campaign for the festive period, when monitoring is thinner and detection slower.

CERT-In named several publicly available offensive tools in use: ARTEX, an open-source multi-agent penetration testing and command-and-control platform; PentAGI, an autonomous multi-agent testing system; Cairn, an attack search engine; and the CyberStrikeAI framework. The agency says they run full attack chains autonomously and adapt payloads to target responses. Attack infrastructure rotates IP addresses within hours to days.

How the attacks worked

The attackers targeted AWS and Lambda infrastructure, entering through non-production environments such as test sites and moving into live systems via shared credentials, tokens or network paths. They reverse-engineered application code and used modified app packages to make unauthorised API calls, defeating controls that trusted only the legitimate client app. Requests were routed through trusted services such as content delivery networks to appear legitimate.

Before larger transfers, the group ran test transactions of Rs 1, and abused merchant settlement APIs at payment aggregators. Crypto exchanges were hit using stolen wallet keys. The actors also quickly exploited newly disclosed flaws in Node.js and PHP.

CERT-In urged all BFSI entities to treat the campaign as an immediate and continuing threat. Detection rules and infrastructure fingerprints have been shared with entities through restricted advisories.