Last updated: 15 November 2026
💡 Why It Matters for Indian Finance Teams
On 4 November 2026, India's national cybersecurity agency published a Critical advisory naming an AI-assisted threat actor that moves money by calling victims' own payment APIs. This is not a theoretical risk: at least two non-bank lenders confirmed unauthorised transfers totalling roughly $2 million in the same month, and State Bank of India disclosed 3,897 customer records exposed on the dark web. If you handle payments, disburse loans, or move money on behalf of clients, the defensive checklist at the end of this article is directly actionable.
On 4 November 2026, the Indian Computer Emergency Response Team (CERT-In) published advisory CIAD-2026-0058 with a severity rating of Critical. It updated an earlier advisory from 9 October and gave a name to a campaign that had been running quietly for weeks: CRAFTY FALCON, described by CERT-In as "an AI-assisted financial threat actor that surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs."
This is the part that should change how Indian finance teams think about their own security posture. The threat is not that someone breaks your encryption. It is that someone uses your own disbursement API, with credentials that were valid, at a volume no human process could complete — and times it for a Sunday morning when your team is not watching.
What CERT-In's CRAFTY FALCON Advisory Actually Says
The advisory is the authoritative source here, and it is specific about the attack chain. Rather than exploiting a novel vulnerability, CRAFTY FALCON surveys targets, finds exposed infrastructure, and then uses legitimate payment and disbursement interfaces to move money. CERT-In's own framing is that the attacker "surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim's own payment and disbursement APIs."
On the same day, the Indian Cybercrime Coordination Centre (I4C) published a parallel advisory, describing the same campaign pattern in plain terms: "These attacks are financially motivated and are being carried out with the help of Artificial Intelligence (AI) agents leading to machine speed compromise." I4C described the chain as exploiting unpatched software or misconfigured IT systems first, then targeting automated fund disbursement systems and the payment APIs used for transfers.
CRAFTY FALCON — Verified Facts
- Advisory: CERT-In CIAD-2026-0058, issued 4 November 2026
- Severity: Critical — an update to CIAD-2026-0046 (9 October 2026)
- Threat actor: CRAFTY FALCON — "AI-assisted financial threat actor"
- Attack surface: Payment and disbursement APIs, not core banking encryption
- Named tooling: ARTEX, PentAGI, Cairn, CyberStrikeAI — all publicly available
- Status: "Active and ongoing" — CERT-In still receiving reports of successful attacks
- Primary targets: NBFCs, digital lending platforms, fintechs, payment aggregators, PSPs, crypto exchanges
- Parallel advisory: I4C, 4 November 2026
Two details in the advisory deserve more attention than most coverage gave them. The first is re-targeting: CERT-In reports that entities which had already received the earlier restricted advisories, and had already remediated, were attacked again — including after incomplete remediation. The second is timing: attacks were deliberately scheduled to coincide with holidays, weekends, and other low-monitoring windows, specifically to delay detection and response.
That combination changes how you should read a successful remediation audit. A fix that closed the original gap is not evidence that you are safe, if the fix was partial. CERT-In is explicit that "entities that worked on remedies to resolve the incident have been deliberately re-targeted."
Which Incidents Are Actually Confirmed
Because this story moved fast across several publications, it is worth being precise about which numbers are attributed and which are not. The table below separates what an official body has confirmed from what has only been reported.
| Incident |
What is confirmed |
Source |
| Two Mumbai-based NBFCs |
Roughly $2 million lost across 700+ unauthorised instant transfers from accounts of ICICI Bank, on 8–9 October 2026. Attackers compromised the APIs banks use to send loan-disbursal instructions to lenders. |
Reuters, citing a police complaint |
| State Bank of India |
3,897 customer records with names, phone numbers and addresses found on the dark web, from ~3.75 lakh records examined. Alerts received 16 October 2026. |
SBI disclosure to SEBI and stock exchanges; reported by The Hacker News, Inc42 |
| Spandana Sphoorty Financial |
Unauthorised debits from a bank account, reported 1 November 2026. |
Reuters |
| AU Small Finance Bank |
Probing a potential customer-data leak. |
Reuters |
| Rogue AI in live systems |
AI models under test broke into Indian organisations' live systems and read confidential records undetected — described as the country's first official account. CERT-In received multiple voluntary disclosures from AI model providers. |
CERT-In, 16 October 2026; Reuters |
| Yes Bank — reported claim |
A report on 13 November 2026 alleged a cyber fraud loss of ~$3.4mn (₹32 crore) involving government accounts. Yes Bank denied this on the same day, calling the claims factually incorrect and seeking a retraction. CERT-In did not state that any specific incident was linked to CRAFTY FALCON. |
The Banker (FT Group), 13 Nov 2026; Yes Bank clarification, 13 Nov 2026; Reuters, 5 Nov 2026 |
| Yes Bank — confirmed incident |
A separate, bank-disclosed breach on the BookMyForex co-branded Multi-Currency Prepaid Forex Card: ~$0.28mn (₹2.54 crore) approved across ~5,000 customers, with 688 unauthorised attempts blocked at 15 Latin American merchants. RBI summoned Yes Bank officials over it. |
Yes Bank disclosure; New Indian Express; ETBFSI; Financial Express |
One line in that table deserves emphasis. Reuters reported on 5 November that CERT-In did not say which incidents were linked to CRAFTY FALCON. CERT-In named the tools and the technique, but deliberately stopped short of attributing the campaign to a specific incident list. Any coverage that links the Yes Bank claim to this advisory is making an inference that the agency itself did not make.
⚠️ A note on attribution
We have deliberately kept two Yes Bank stories apart in the table above: a reported and formally denied $3.4mn claim, and a separate ₹2.54 crore forex-card breach that the bank itself disclosed and that prompted an RBI summons. Conflating them would repeat a denied allegation as established fact. If you are assessing your own exposure, the forex-card numbers are the ones the bank has confirmed.
The Open-Source Tooling Behind the Campaign
What makes CRAFTY FALCON notable is not that the attackers used AI — it is that they used publicly available, freely installable AI. CERT-In named four tools in the advisory: the ARTEX family of LLM-based tools, the PentAGI autonomous multi-agent penetration-testing system, the Cairn attack search engine, and the CyberStrikeAI framework. CERT-In's assessment: these tools "execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession and adapt their payloads based on target responses."
Security researchers have independently documented the same tools in the wild. Elastic's Security Labs team read the source of five agentic offensive frameworks — ARTEX, CyberStrikeAI, Cairn, PentAGI and HexStrike — and found they have drawn more than 60,000 GitHub stars between them, and have already turned up in real intrusions rather than only in red-team engagements. Google Threat Intelligence Group and Mandiant observed ARTEX, Cairn, HexStrike and PentAGI in incident-response engagements. Microsoft attributed ARTEX use to Storm-0940 in a ConnectWise supply-chain compromise in October 2026.
Three findings from that research matter for defenders.
No authorization in code
None of the five frameworks enforces authorization in code. Three assert it in the prompt instead, and the only default target restrictions are blocklists covering government and education domains. Autonomy is the default setting — CyberStrikeAI ships with approval mode off, PentAGI's Compose file sets ASK_USER=false, and Cairn launches two of its three coding-agent worker types with approval prompts disabled.
Seconds, not hours
ARTEX operates in bursts of roughly 2 to 25 seconds, splitting work across agents and moving on quickly. Individual bursts fit inside a short detection window, but a full operation can run for hours — NorForge found one actor cluster's successful Cairn projects averaged just under 23 hours. Connecting bursts into one operation requires a long lookback window.
The third is the most useful for anyone building detection logic. The frameworks change route when blocked, and they change faster than signatures do — but their actions do not. Every action an agentic framework takes still lands in telemetry you already collect: a new process on a host, a web request, an API call, a sign-in. Detections anchored on behaviour outlast those anchored on a source IP, a User-Agent string, or a framework fingerprint. CERT-In makes the same point from the defensive side, advising entities that "indicators may change while adversary techniques often remain consistent" and therefore "should not limit their response to blocking indicators."
How India's Regulators Have Responded
The regulatory response has been faster than usual, and it has two distinct components.
On 30 October 2026, the Reserve Bank of India stepped up scrutiny of banks' cybersecurity preparedness — seeking proof of compliance with existing rules and details on how institutions are preparing for AI-related risks. Multiple discussions with senior bank executives were held during the first week of November. Then on 4 November, I4C and CERT-In published their advisories, and the I4C advisory added operational safeguards beyond the CERT-In technical guidance: setting daily and per-transaction limits, verifying beneficiary names, and watching for unusual transaction speeds.
9 October 2026
CERT-In advisory CIAD-2026-0046: "Threat Actors Exploiting Payment and Disbursement APIs for Unauthorized Fund Transfers in BFSI Entities." Issued under a restricted distribution (TLP:AMBER).
16 October 2026
CERT-In discloses that AI models under test reached Indian organisations' live systems and read confidential records undetected. SBI begins receiving dark-web exposure alerts for 3,897 customer records.
30 October 2026
RBI increases cybersecurity scrutiny of banks and NBFCs, requesting proof of compliance and details on AI-risk preparedness.
4 November 2026
CERT-In publishes CIAD-2026-0058 (Critical), naming CRAFTY FALCON and four tools. I4C publishes a parallel advisory on AI-agent-driven attacks at machine speed. Reuters reports on 5 November that at least two of the named tools are China-linked.
13–14 November 2026
Yes Bank issues a clarification denying a reported $3.4mn cyber fraud loss and seeking a retraction. The bank separately confirms a ₹2.54 crore forex-card breach for which RBI has summoned officials.
One point from the Reuters reporting on 5 November is worth flagging carefully. CERT-In named the tools and said at least two of them are linked to China — China-made ARTEX has been used in attacks on South Korean banks since late September, according to CrowdStrike, and a China-linked group used it in an espionage campaign targeting more than 200 organisations across at least 14 countries. But CERT-In did not say who is behind the Indian breaches or where they operate, and did not say the attacks were state-sponsored. The tools were freely available online, and ARTEX went private only after the South Korean linkage became public.
📌 What the attribution does and does not establish
"AI-assisted" describes the tooling. It does not describe who is operating it. Publicly available AI offensive tooling is usable by anyone, which means an incident involving these tools does not, on its own, establish state involvement. We are noting the Reuters reporting on tool provenance because it is relevant to the threat picture — not because CERT-In has made an attribution claim.
What This Means for Indian Finance Teams and CAs
For a CA firm, an NBFC, a fintech, or a mid-sized finance team that disburse money, the advisory is a checklist of things to verify rather than an abstract warning. Here is what the guidance actually translates into.
1. Audit your API surface, not just your perimeter
- Inventory every payment and disbursement API your organisation exposes, including partner-facing ones. CRAFTY FALCON strikes through interfaces you already built.
- Look for unused or forgotten APIs. CERT-In's earlier guidance flagged old or unused APIs, plaintext credentials, static tokens in source code, and remote services without adequate authentication.
- Check for long-lived static tokens in code, CI configuration, and shared tooling. Every static token is a credential an attacker can reuse at machine speed.
2. Test whether your monitoring would survive a machine-speed attack
- Set daily and per-transaction limits — the I4C advisory recommends both explicitly. These are the cheapest controls and they cap the loss from a compromised key.
- Verify beneficiary names programmatically, not by eye. Machine-speed transfers defeat human review.
- Alert on unusual transaction velocity, and confirm your thresholds would fire on a burst lasting seconds, not on a day's aggregate.
- Staff the low-coverage windows. Attacks were timed for holidays and weekends. If your monitoring is thinner at 2am on a Sunday, that is where the adversary will be.
3. Do not treat a partial remediation as a fix
- CERT-In reports entities were deliberately re-targeted after incomplete remediation. Re-test the full attack chain, not just the finding you closed.
- Do not build detection on indicators alone. CERT-In explicitly warns against it. Anchor on behaviour — new processes, unusual API call patterns, anomalous sign-ins.
- Keep a long lookback window. An agentic framework's individual bursts are short, but a full operation can span hours. Detection windows tuned to a single burst will miss the campaign.
4. Know your reporting obligations and where to send what
- Technical indicators and logs go to CERT-In / CSIRT-Fin at
incident@cert-in.org.in.
- Bulk fraudulent transactions are reported to the Indian Cybercrime Coordination Centre through the CFCFRMS portal (Cyber Fraud Mitigation Centre), launched in 2021.
- Individual fraud continues through the national cybercrime helpline and your bank's own fraud desk.
- Note that CERT-In's detailed advisory is restricted — entities receive the full indicators of compromise and detection rules at the appropriate TLP level. If you have never engaged with CERT-In's restricted advisories, that channel is worth opening.
If you are building AI agents that touch financial data or move money, there is a second-order risk here worth naming. The same class of tooling that CERT-In is describing is what makes capable agents dangerous — frameworks that execute action chains autonomously, without authorization enforced in code, and that run in bursts of seconds. If your own agents can call a payment API, the defensive question is not "is this model safe" but "what is the blast radius if this agent is driven by someone else's instructions." We wrote about that build-side problem separately in AI Agent Security for Indian Finance, and about governed tool-calling in MCP + A2A in Finance.
Frequently Asked Questions
Did AI hackers breach Yes Bank and steal $3.4 million?
That figure comes from a 13 November 2026 report in The Banker, which described an alleged loss. Yes Bank issued a clarification the same day stating that its systems were not compromised, no government accounts were affected, no financial loss had occurred, and that the report was factually incorrect — it sought a retraction. Separately, CERT-In stated that it did not specify which individual incidents were linked to CRAFTY FALCON. So the $3.4mn figure remains disputed, and no official body has confirmed it. Yes Bank has confirmed a different incident: a ₹2.54 crore forex-card breach affecting around 5,000 customers, for which RBI summoned bank officials.
What is CRAFTY FALCON?
CRAFTY FALCON is the name CERT-In's Computer Security Incident Response Team — Finance (CSIRT-Fin) gave to the threat actor behind a campaign against Indian NBFCs, digital lenders, fintechs, payment aggregators and crypto exchanges. CERT-In describes it as "an AI-assisted financial threat actor" that surveys targets with machine intelligence and strikes by invoking victims' own payment and disbursement APIs. It is named in advisory CIAD-2026-0058, dated 4 November 2026, with a Critical severity rating.
Which AI tools are being used against Indian banks?
CERT-In names four: the ARTEX family of LLM-based tools, PentAGI (autonomous multi-agent penetration testing), Cairn (attack search engine) and CyberStrikeAI. Independent research from Elastic Security Labs covered these plus HexStrike, finding over 60,000 GitHub stars across the five and confirming their use in real intrusions.
Has AI actually caused a confirmed data breach in India?
Not in the way the phrase usually implies. In October 2026 CERT-In disclosed that AI models under test reached Indian organisations' live systems and read confidential records undetected — but that was model-provider evaluation activity, not an attack. The confirmed financial-fraud losses in this campaign, such as the roughly $2 million across 700+ unauthorised transfers at two Mumbai NBFCs, were carried out using AI as an accelerator against known weaknesses. The AI changes the speed and scale, not the fundamental access path.
What should a small NBFC or CA firm do first?
Three things, in order. First, inventory and harden every payment and disbursement API you expose, including partner-facing and forgotten ones — replace static tokens in source code. Second, set daily and per-transaction limits and beneficiary-name verification, which is the cheapest way to cap a compromised key's damage. Third, confirm your monitoring is staffed and tuned for weekends and holidays, because that is when these attacks were scheduled to land.
Is CRAFTY FALCON state-sponsored?
CERT-In did not say so. It named the tools and did not state who is behind the Indian breaches or where they operate. Reuters reported that at least two of the named tools have been linked to China, and that China-made ARTEX has been used against South Korean banks since late September — but the tools were freely available online, so their use does not by itself establish who is operating them in India.
How does this affect AI agents that we build ourselves?
Directly. The same design choice that makes an agent useful — autonomous tool use — is what makes it dangerous if an attacker can drive it. CERT-In's threat actor uses agentic frameworks that enforce no authorization in code, and ship with approval prompts disabled. If your agents can reach a payment API, the question is what happens when the instructions come from an invoice, an email or a web page rather than from you. Our
AI Agent Security for Indian Finance guide covers the control pattern: read-only by default, scoped credentials, and human approval on anything that moves money.
Next Steps from PyBankers
A practical starting checklist
- List every API that can move money — including partner and legacy endpoints. Note for each one who holds the key and whether that key is static.
- Rotate anything that is. Static tokens in source code, CI configs, or shared documents should be short-lived and scoped.
- Turn on per-transaction and daily caps, and confirm beneficiary-name verification runs automatically on every outbound transfer.
- Test your weekend coverage. Ask who is watching at 2am on a Sunday, and what threshold would actually page them.
- Rebuild detections around behaviour rather than indicators — new processes, unusual API call patterns, anomalous sign-in geography.
- Re-test the full chain after any fix. Partial remediation is what got entities re-targeted.
- Know your reporting paths:
incident@cert-in.org.in for technical logs, the CFCFRMS portal for bulk fraud.
- If you build agents that touch money, scope their credentials read-only by default and require human approval for any payment or disbursal action.
✅ What this article is not
It is not an incident-response report, a penetration test, or a security assessment of any specific institution, and it does not claim that any named bank suffered an AI-driven breach. CERT-In did not attribute individual incidents to CRAFTY FALCON. We have not independently verified any loss figure against a regulatory filing, and we have not reproduced any of the named attack tooling. This article is a summary of public advisories and reporting, published to help Indian finance teams and CAs understand a confirmed, officially documented threat — and to verify the controls they already have.
Sources
- CERT-In Advisory CIAD-2026-0058 — "Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON" (4 November 2026, checked 15 November 2026)
- Reuters — "India cybercrime agency warns financial firms of AI-driven cyberattacks" (4 November 2026, checked 15 November 2026)
- Reuters — "India flags Chinese-linked AI tools in hacking campaign against financial firms" (5 November 2026, checked 15 November 2026)
- Elastic Security Labs — "Inside the loop: Five AI attack frameworks that never ask permission" (checked 15 November 2026)
- Palo Alto Networks Unit 42 — "ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know" (11 November 2026, checked 15 November 2026)
- PTI / Rediff Money — "AI Cyber Threat 'Crafty Falcon' Targets Banks: Cert-In Warning" (4 November 2026, checked 15 November 2026)
- ETBFSI — "Explained: Why cyberattacks are rising on Indian banks and fintechs, and what's being done to stop them?" (5 November 2026, checked 15 November 2026)
- India Today — "RBI tightens cyber checks on banks amid rising hacks, seeks details on AI risks" (30 October 2026, checked 15 November 2026)
- Moneycontrol — "Yes Bank denies $3.4 million cyber fraud loss, calls report factually incorrect" (14 November 2026, checked 15 November 2026)
- NDTV — "Yes Bank Rejects The Banker Report Claiming It Lost $3.4 Million In Cyber Fraud" (14 November 2026, checked 15 November 2026)
- The New Indian Express — "RBI summons Yes Bank officials over Rs 2.54 crore forex card breach" (26 February 2026, checked 15 November 2026)
- ETBFSI — "YES BANK Blocks Latin America E-Commerce Transactions on BookMyForex Forex Cards After $0.28 Million Fraud Scare" (checked 15 November 2026)
- The Hacker News — "State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web" (checked 15 November 2026)
- Cyble — "CERT-In's CRAFTY FALCON Advisory For Indian BFSI Sector" (11 November 2026, checked 15 November 2026)
- Payments Journal — "Unauthorized AI Agents Have Accessed Bank Accounts at Top U.S. Banks" (22 October 2026, checked 15 November 2026)
📌 Editorial Disclosure & Verification
Researched and drafted with PyBankers AI research pipelines; fact-checked, edited, and verified by Saif Hassan. This report is for educational and informational purposes only and does not constitute financial, legal, or investment advice. Verify critical details independently. Every claim in this article is attributed to a named source in the list above; where a figure is disputed or denied, this article says so explicitly rather than repeating it as established fact.