---
title: CERT-In names 'CRAFTY FALCON', an AI-assisted actor draining Indian lenders, fintechs and crypto exchanges by calling their own payment APIs | ctxsec
url: https://ctxsec.com/items/cert-in-ciad-2026-0058-crafty-falcon-ai-assisted-bfsi-payment-api-attacks
description: "India's CERT-In (via its finance CSIRT) says a campaign it first flagged on Oct 9 has escalated and is active and ongoing, including against entities that had already received earlier restricted advisories and remediated. The actor uses public AI offensive tools (the ARTEX family, PentAGI, the Cairn search engine and CyberStrikeAI), gets in through exposed UAT/staging environments, cloud management services (e.g. AWS Systems Manager, Lambda), stolen static API tokens and newly published file-upload and deserialization bugs, then reverse-engineers apps and calls payment and disbursement APIs directly with modified clients. It tests with \u20b91 transactions before large transfers to mule accounts, abuses payment aggregators' merchant settlement APIs, times attacks for holidays and weekends, and has stolen wallet keys at crypto exchanges."
status: "official (CERT-In advisory CIAD-2026-0058, Nov 4, severity Critical)"
published: 2026-11-04
---

> India's CERT-In (via its finance CSIRT) says a campaign it first flagged on Oct 9 has escalated and is active and ongoing, including against entities that had already received earlier restricted advisories and remediated. The actor uses public AI offensive tools (the ARTEX family, PentAGI, the Cairn search engine and CyberStrikeAI), gets in through exposed UAT/staging environments, cloud management services (e.g. AWS Systems Manager, Lambda), stolen static API tokens and newly published file-upload and deserialization bugs, then reverse-engineers apps and calls payment and disbursement APIs directly with modified clients. It tests with ₹1 transactions before large transfers to mule accounts, abuses payment aggregators' merchant settlement APIs, times attacks for holidays and weekends, and has stolen wallet keys at crypto exchanges.

[← Cybersecurity News](/news) · [markdown](/items/cert-in-ciad-2026-0058-crafty-falcon-ai-assisted-bfsi-payment-api-attacks.md)

official (CERT-In advisory CIAD-2026-0058, Nov 4, severity Critical)

2026-11-04

### CERT-In names 'CRAFTY FALCON', an AI-assisted actor draining Indian lenders, fintechs and crypto exchanges by calling their own payment APIs

- **Notable trick:** IP allow-lists were bypassed by sending traffic through whitelisted third-party fetcher pools (content-acceleration and app-store review fetchers) that anyone can make fetch a URL. Don't treat shared provider ranges as trusted callers.
- Isolate non-production from production: no shared credentials, tokens or network paths.
- Require request signing and server-side validation on payment and disbursement APIs; don't assume only your own app calls them.
- Replace long-lived static API tokens, enforce MFA on remote access, and alert on micro-value test transactions followed by large transfers, especially off-hours.

Sources: [CERT-In Advisory CIAD-2026-0058 (copy published by MediaNama)](https://www.medianama.com/wp-content/uploads/2026/11/CERT-In-Advisory.pdf) · [The Indian Express: CERT-In warns of 'Crafty Falcon' AI cyberattack campaign](https://indianexpress.com/article/technology/tech-news-technology/cert-in-crafty-falcon-ai-driven-hacking-campaign-fintech-10951672/)