CERT-In Warns Banks and Fintechs of Crafty Falcon, an AI-Assisted Campaign Draining Funds Through Their Own Payment APIs

India's Computer Emergency Response Team (CERT-In) has warned banks, non-bank lenders, payment firms and crypto exchanges that a campaign it calls Crafty Falcon is stealing money by invoking the victims' own payment and disbursement APIs with the help of AI-driven attack tools. The advisory, issued on 4 November, reports "a significant escalation" since CERT-In's 9 October alert on payment and disbursement APIs. No loss figure or victim list has been published with it.

In several cases, IANS reports, the attackers returned to target entities where identified weaknesses had not been fully addressed.

How the attacks work

Elets BFSI names four public AI-driven offensive tools in use: ARTEX, PentAGI, Cairn and CyberStrikeAI. Before a big transfer, the attackers make test transactions of Rs 1, and they time operations for weekends and holidays, when fewer people are watching.

Gujarat Samachar's summary of the advisory describes a way in through internet-facing testing and staging environments, then on to production through shared credentials and tokens. Inside, the attackers misuse AWS Systems Manager and Lambda to run commands. Modified app packages send unauthorised API calls.

IP allow-lists are sidestepped by routing requests through allow-listed third-party services, and payment aggregators are hit through their merchant settlement APIs. The attackers also exploit newly disclosed file-upload and deserialisation flaws in PHP and Node.js applications and steal crypto exchanges' wallet keys.

IANS separately reports that State Bank of India, AU Small Finance Bank and Spandana Sphoorty were among lenders attacked in October. It doesn't tie those incidents to Crafty Falcon.

What CERT-In tells financial firms to do

• Separate test from production: "UAT, staging and testing environments must be fully isolated from production", with no shared credentials or tokens.
• Watch around the clock: 24×7 security monitoring with increased staffing.
• Flag the test pattern: the advisory, as Gujarat Samachar summarises it, asks firms to flag small-value transfers to new beneficiaries followed by high-value transactions.