CERT-In flags AI-powered 'Crafty Falcon' attacks on banks and fintechs
Synopsis
CERT-In's 'Crafty Falcon' warning is not a routine advisory — it is a signal that AI has fundamentally changed the attacker's toolkit. With financial institutions being hit twice despite prior warnings, and with AI automating everything from script generation to malware adaptation, India's financial sector faces a threat that scales faster than its defences. The holiday-timing tactic alone exposes a structural gap no patch can fully close.
Key Takeaways
CERT-In issued a fresh advisory on 5 November 2026 warning banks, NBFCs and fintechs of the escalating 'Crafty Falcon' cyber campaign.
The campaign uses AI-powered tools to automate attack scripts, adapt malware in real time, and operate with minimal human input.
Attackers deliberately target weekends and public holidays to exploit reduced security oversight.
Some organisations hit a second time had already taken corrective action after earlier CERT-In warnings — but had not fully remediated vulnerabilities.
Confirmed victims in October include State Bank of India , AU Small Finance Bank , and Spandana Sphoorty .
Low-value test transactions and traffic routed through trusted third-party services are key evasion tactics flagged in the advisory.
The Indian Computer Emergency Response Team (CERT-In) has issued a fresh advisory warning banks, non-banking finance companies (NBFCs), fintech firms and other financial institutions of an escalating cyber campaign linked to unauthorised fund transfers. The warning, issued on 5 November 2026, marks a significant intensification of an ongoing threat that the watchdog first flagged in October.
What Is the 'Crafty Falcon' Campaign
CERT-In has dubbed the threat cluster 'Crafty Falcon' — a coordinated cyber campaign that deploys artificial intelligence-powered offensive tools to automate attacks and rapidly exploit vulnerabilities in financial systems. According to the advisory, threat actors are leveraging publicly available AI-driven platforms capable of generating customised attack scripts, adapting malware in real time based on system responses, and executing large segments of the intrusion with minimal human intervention.
The campaign has evolved to exploit multiple entry points: internet-facing testing environments, cloud infrastructure, application vulnerabilities, and compromised credentials. Modified mobile applications and unauthorised API calls have also been used to initiate fraudulent transactions.
Key Attack Tactics Identified
CERT-In's investigation highlighted several methods that make Crafty Falcon particularly difficult to counter. Attackers have timed operations to coincide with weekends, public holidays, and other periods of reduced security staffing — deliberately exploiting gaps in monitoring coverage. Malicious traffic is reportedly routed through trusted third-party services to bypass security controls, while low-value transactions are used to probe compromised systems before larger fund transfers are attempted.
Notably, the advisory warns that some organisations which had already undertaken corrective measures following earlier warnings were targeted again — in cases where identified weaknesses had not been fully remediated.
October Attacks: Banks Already Hit
The fresh alert follows a series of cyberattacks on Indian lenders in October, with reports of successful intrusions at institutions including State Bank of India, AU Small Finance Bank, and Spandana Sphoorty. CERT-In noted that it continues to receive reports of successful breaches even from entities that had acted on prior advisories, underscoring the adaptive nature of the threat actors involved.
The October advisory had specifically flagged misuse of payment and disbursement APIs as a primary vector for fraudulent fund transfers — a tactic that Crafty Falcon has since weaponised at greater scale and speed.
What Financial Firms Must Do Now
CERT-In's advisory calls on financial institutions to urgently audit their API security, harden cloud and testing environments, monitor for anomalous low-value transaction patterns, and ensure that previously flagged vulnerabilities are fully patched — not merely acknowledged. Enhanced logging and round-the-clock security operations coverage during holidays and weekends are also recommended. The advisory signals that India's financial sector faces a structurally new threat environment, where AI amplifies attacker speed and adaptability in ways that traditional rule-based defences struggle to match.
Point of View
Static patch cycles are inadequate by design. India's financial regulators — the Reserve Bank of India in particular — will need to consider whether compliance checklists are sufficient, or whether mandatory real-time threat-intelligence sharing across the sector is now overdue.
NationPress
5 Nov 2026
Frequently Asked Questions
What is the 'Crafty Falcon' cyberattack campaign?
'Crafty Falcon' is an AI-powered cyber campaign targeting Indian banks, NBFCs and fintech firms, identified by CERT-In. It uses publicly available AI-driven offensive platforms to automate attack scripts, adapt malware in real time and carry out intrusions with minimal human intervention, primarily to facilitate unauthorised fund transfers.
Which financial institutions have been affected?
CERT-In reported successful intrusions at several lenders in October, including State Bank of India, AU Small Finance Bank and Spandana Sphoorty. The advisory notes that breaches continue to be reported even from organisations that had already implemented corrective measures after earlier warnings.
How are the attackers gaining access to financial systems?
Attackers are exploiting internet-facing testing environments, cloud infrastructure weaknesses, application vulnerabilities and compromised credentials. Modified mobile applications and unauthorised API calls are also being used to initiate fraudulent transactions.
Why are attacks timed to weekends and holidays?
CERT-In flagged that threat actors are deliberately scheduling operations during weekends, public holidays and other low-staffing periods to reduce the likelihood of timely detection and response — exploiting gaps in human monitoring coverage.
What should banks and fintechs do in response to this advisory?
CERT-In recommends urgently auditing API security, fully remediating previously flagged vulnerabilities rather than partially addressing them, hardening cloud and test environments, monitoring for low-value anomalous transactions, and maintaining round-the-clock security operations during holidays. Routing of malicious traffic through third-party services should also be a monitoring priority.
