CERT-In names 'CRAFTY FALCON', an AI-assisted actor draining Indian lenders, fintechs and crypto exchanges by calling their own payment APIs
- Notable trick: IP allow-lists were bypassed by sending traffic through whitelisted third-party fetcher pools (content-acceleration and app-store review fetchers) that anyone can make fetch a URL. Don't treat shared provider ranges as trusted callers.
- Isolate non-production from production: no shared credentials, tokens or network paths.
- Require request signing and server-side validation on payment and disbursement APIs; don't assume only your own app calls them.
- Replace long-lived static API tokens, enforce MFA on remote access, and alert on micro-value test transactions followed by large transfers, especially off-hours.
Sources: CERT-In Advisory CIAD-2026-0058 (copy published by MediaNama) · The Indian Express: CERT-In warns of 'Crafty Falcon' AI cyberattack campaign