CERT-In Flags AI-Driven Cyberattacks On Indian BFSI

India’s cybersecurity watchdog CERT-In has issued a critical warning to entities in the banking, financial services and insurance (BFSI) sector over an escalating campaign of AI-driven cyberattacks targeting payment and disbursement APIs.

In an advisory dated November 4, 2026, the Indian Computer Emergency Response Team (CERT-In) identified the threat actor behind the campaign as ‘CRAFTY FALCON’, describing it as an AI-assisted financial threat actor that uses machine intelligence to identify targets, execute attacks at machine speed and exploit victims’ own payment and disbursement APIs to initiate unauthorised fund transfers.

Banks, non-banking financial companies (NBFCs), fintech companies and other financial services entities have been warned of the growing threat.

CERT-In’s Computer Security Incident Response Team-Finance (CSIRT-Fin) said the campaign has witnessed a significant escalation, with successful attacks continuing to be reported across the financial services ecosystem. The agency has urged all BFSI entities to treat the campaign as an immediate and continuing threat.

Repeat Attacks Despite Remediation

A key concern highlighted in the advisory is the threat actor’s continued targeting of financial entities that had already received earlier restricted advisories and undertaken remediation measures.

According to CERT-In, some of these organisations have been deliberately targeted again, including cases where remediation was incomplete. The attacks have also been timed to coincide with holidays, weekends and other periods of reduced monitoring, potentially delaying detection and response.

CERT-In’s analysis identified the use of multiple publicly available AI-driven offensive security tools in the campaign. These include the ARTEX family of large language model (LLM)-based tools, PentAGI, an autonomous multi-agent AI penetration testing system, and the Cairn attack search engine, alongside the CyberStrikeAI framework.

These tools can execute complete attack chains autonomously, generate and refine large volumes of customised attack scripts in rapid succession, and adapt their payloads based on responses from targeted systems.

The supporting attack infrastructure also changes frequently, with IP addresses rotating within hours to days. CERT-In said infrastructure fingerprints and detailed detection rules have been shared with affected entities through restricted advisories.

AI Agents Pose Growing Cybersecurity Risks

The latest advisory follows another critical warning issued by CERT-In in October, when the agency flagged attackers using publicly available agentic AI tools to conduct financially motivated intrusions into Indian organisations.

The watchdog warned that autonomous AI agents, ostensibly deployed for research and evaluation, had accessed live systems without authorisation, reading business records containing personal data and confidential information.

Meanwhile, the Indian Cyber Crime Coordination Centre (I4C) has also warned banks, NBFCs and fintech startups about the growing use of AI agents by cybercriminals to perpetrate financial fraud.

The agency said it had uncovered multiple individual cases in which malicious agentic AI systems exploited compromised financial systems to execute unauthorised transactions involving amounts running into crores of rupees.

CERT-In Flags Vulnerabilities In Tata Motors’ Connected Vehicle Apps

Separately, CERT-In has flagged multiple vulnerabilities in select versions of Tata Motors’ iRA 2.0 and iRA.ev connected vehicle applications, which could allow attackers to access sensitive credentials and vehicle-related information.

The agency identified four vulnerabilities, including hardcoded service account credentials, API keys and authorisation tokens within the applications; inadequate validation of URLs and origins loaded through the apps’ WebView component; authentication tokens being recorded in application logs; and improper implementation of SSL certificate pinning in the network security configuration.

CERT-In has urged users to update their applications to the latest versions of iRA 2.0 (version 26.8.2) and iRA.ev (version 26.9.1).

The applications provide access to connected vehicle functionalities, including vehicle status updates, health monitoring, trip details and remote vehicle commands.

The post CERT-In Flags AI-Driven Cyberattacks On Indian BFSI appeared first on Inc42 Media.