New Delhi: India's cybercrime and cybersecurity authorities have warned banks, financial institutions and fintech companies about escalating cyberattacks involving artificial intelligence agents. Criminals are increasingly using these tools to identify security weaknesses, exploit payment systems and carry out unauthorised financial transactions.
The Indian Cyber Crime Coordination Centre (I4C), working with the Indian Computer Emergency Response Team (CERT-In), issued an alert on November 3 about financially motivated attacks targeting the country's financial sector. On November 4, CERT-In issued a separate critical advisory identifying the escalating campaign as CRAFTY FALCON.
The latest advisory described attacks targeting banks, non banking financial companies, fintech firms, payment service providers, payment aggregators and cryptocurrency exchanges. Authorities also reported attempts to steal cryptocurrency wallet keys and transfer funds from digital wallets.
According to CERT-In, attackers are using artificial intelligence tools to examine financial institutions' computer systems, identify vulnerabilities and carry out several stages of cyberattacks with limited human involvement. These tools can generate customised scripts rapidly and adjust their methods in response to the security systems they encounter.
The agency identified several publicly available tools being used in these operations, including ARTEX, PentAGI, Cairn and CyberStrikeAI. These tools can automate reconnaissance, vulnerability testing and other stages of cyberattacks, making it more difficult for security teams to detect and stop intrusions.
One of the main concerns is the exploitation of application programming interfaces, commonly known as APIs. These are software connections that allow different computer systems to exchange information and perform operations.
Financial institutions use APIs to process payments, release loans and transfer money between systems. However, attackers who gain access to these connections can misuse them to initiate transactions without proper authorisation.
CERT-In reported that some attackers first conducted small transactions, including transfers of as little as one rupee, to check whether their access was working. They then attempted larger transfers through payment systems and accounts used to move illegally obtained money.
Authorities also reported that some organisations had faced repeated attacks despite taking steps to correct previously identified security weaknesses. Incomplete repairs and poor separation between testing and operational systems allowed attackers to regain access.
Another concern is the timing of the attacks. According to the advisory, some operations were planned during weekends and holidays, when security monitoring could be reduced.
The latest warning follows two earlier critical advisories issued by CERT-In in October. An advisory on October 9 described attacks exploiting payment and fund disbursement APIs, while another on October 15 highlighted cases involving AI agents accessing live computer systems and the misuse of publicly available AI security tools.
The October 15 advisory described cases in which AI agents being tested by providers exceeded their assigned permissions and accessed live computer systems belonging to Indian organisations. They gained access to business records containing personal and confidential information through exposed credentials and weaknesses in system configurations.
The agency also warned that criminals were using autonomous AI tools to identify and exploit weaknesses in Indian information technology systems. It reported that these tools had reduced the time between gaining initial access and carrying out damaging activities from days to a few hours.
The incidents have raised concerns about the security of India's financial sector. On October 30, Reuters reported that two Mumbai based non banking financial companies had lost approximately $2 million through more than 700 unauthorised instant transfers on October 8 and 9.
According to a police complaint reviewed by Reuters, the attackers allegedly exploited an API connection used to send loan disbursement instructions to ICICI Bank. However, there is no confirmed evidence that this incident was connected to the CRAFTY FALCON campaign or that artificial intelligence tools were used.
The Reserve Bank of India (RBI) has also increased its attention to cybersecurity arrangements among financial institutions. Reports indicated that the central bank had asked banks to demonstrate compliance with existing security requirements and explain their preparedness for AI related threats.
The developments come after a cybersecurity incident involving the State Bank of India, the country's largest lender. On October 21, the bank disclosed that approximately 375,000 records had appeared in a dataset on the dark web. Of these, 3,897 contained personally identifiable customer information.
SBI engaged an independent cybersecurity agency to investigate the incident. The bank said the breach had no material impact on its core business operations or financial performance and subsequently took steps to strengthen its cybersecurity arrangements.
Indian authorities are urging financial institutions to improve their security systems and monitor transactions continuously. They have recommended stronger authentication measures, strict separation between testing and operational systems, daily and per transaction payment limits, and verification of beneficiary details before money is transferred.
Banks have also been advised to monitor unusually rapid transactions and restrict administrative access to critical systems. Financial institutions are required to report specified cyber incidents to CERT-In within six hours of detection. Banks and non banking financial companies must also report relevant incidents to the RBI through its DAKSH portal within the same period.
The growing threat comes against the background of widespread financial cybercrime in India. Government figures released in July showed that more than 53.87 lakh cyber fraud complaints were recorded during the financial years 2023 to 2024, 2024 to 2025 and 2025 to 2026. The reported fraud amount exceeded Rs 56,087 crore.
However, these figures cover different forms of cybercrime and do not represent losses caused specifically by AI driven attacks.
The latest warnings highlight the growing challenge facing financial institutions as criminals adopt more advanced technologies. While artificial intelligence can help banks improve services and strengthen security, it can also help criminals identify and exploit weaknesses more quickly.
Indian authorities are urging financial institutions to treat cybersecurity as a continuous responsibility, warning that weaknesses in interconnected financial systems could expose both organisations and their customers to serious financial and data security risks.