CERT-In CRAFTY FALCON Alert: AI Attacks on Indian Fintech and How to Defend (Nov 2026)

On November 4, 2026, CERT-In issued a critical alert about a threat group it calls CRAFTY FALCON. The group is attacking Indian crypto exchanges, NBFCs and fintech payment platforms using AI attack tools that can run whole attack sequences on their own. Around the same time, I4C's National Cybercrime Threat Analytics Unit and CERT-In warned banks, NBFCs and fintechs about AI-driven attacks that move money at "machine speed".

Here is what the advisories say, how these attacks work, and a practical checklist for security and payments teams, plus what ordinary customers should know.

Quick answer: CRAFTY FALCON abuses victims' own payment APIs, sends tiny ₹1 test transactions to confirm a route, then moves larger sums to mule accounts, often on weekends and holidays. CERT-In says it uses the AI tools PentAGI and CyberStrikeAI. Defend with an API inventory, cooling periods for new beneficiaries, transaction limits and velocity alerts, HSM or cold storage plus multi-signature for crypto withdrawals, faster patching, and extra SOC cover on holidays.

Last updated: November 12, 2026.

Table of contents

• What CERT-In and I4C announced
• How the attack works
• Attack and defence flow
• Why "AI agents" change the game
• Defence checklist for fintechs and NBFCs
• Extra steps for crypto platforms
• What customers should do
• FAQ

What CERT-In and I4C announced

Issued by	CERT-In (CSIRT-Fin, its finance-sector unit) and I4C's National Cybercrime Threat Analytics Unit
Date	CERT-In advisory dated November 4, 2026; reported November 5, 2026
Severity	Critical
Threat group	CRAFTY FALCON
AI tools named	PentAGI and CyberStrikeAI
Targets	Crypto exchanges, virtual digital asset service providers, NBFCs, fintech payment platforms, banks
Impact	Unauthorised transactions worth crores in individual cases (per the I4C/CERT-In warning)

The advisories don't name affected companies or publish total losses.

How the attack works

1. Get in: exploit unpatched software or misconfigured internet-facing servers.
2. Find the money pipes: locate fund-disbursement systems and payment APIs, including old or test APIs nobody remembers.
3. Test the route: send a tiny payment, such as ₹1, to confirm the path works.
4. Cash out: move larger amounts to mule accounts across several banks, then withdraw through IMPS and NEFT. For crypto platforms, steal wallet keys and drain exchange wallets.
5. Cover tracks: delete records to slow the investigation.
6. Come back: CERT-In says the group has returned to firms that fixed earlier issues, looking for new ways in.

Attacks are timed for weekends and holidays, when security teams are thin.

Attack and defence flow

Why "AI agents" change the game

CERT-In says PentAGI and CyberStrikeAI are built into the attack chain and can run full attack sequences on their own, adjusting as the target responds. I4C's warning says an "agentic AI framework" makes attacks possible "at machine speed". In practice that means:

• Less time to react. Steps that once took a human hours can happen in minutes.
• Constant probing. Automated tools keep testing for the next weak API or unpatched server.
• Controls must be automatic too. Limits, cooling periods and velocity alerts work even when nobody is watching.

Defence checklist for fintechs and NBFCs

1. Inventory every payment API. Remove or disable old, unused and test interfaces.
2. Patch internet-facing systems fast and fix misconfigurations; run regular external scans.
3. Add a cooling period for new beneficiaries before large payouts are allowed.
4. Set daily and per-transaction limits and verify beneficiary names against account numbers.
5. Alert on velocity: unusually fast transactions, sudden changes in narration patterns, beneficiary profiles or volumes, and tiny "test" payments to new beneficiaries.
6. Block payouts until every check is done: KYC, approvals and limits.
7. Watch token failures from non-whitelisted IPs on API gateways.
8. Harden complaint and customer-facing systems, a known entry point.
9. Review architecture to stop lateral movement: segment payment systems from general IT.
10. Staff up on holidays and weekends and lower alert thresholds during those windows.
11. Run red-team drills that simulate machine-speed attacks and measure how fast your SOC and payment controls react.
12. Get CISO, fraud and IT teams on one page. API attacks sit between all three.

Microsoft 365 shops can turn several of these into alerts; see our custom detection rules in Defender and advanced hunting queries.

Extra steps for crypto platforms

• Keep wallet keys in hardware security modules (HSMs) or cold custody.
• Require multi-signature approval for withdrawals.
• Accept that these controls may slow some routine payouts. CERT-In's guidance treats that as the price of safety.

What customers should do

The advisories target companies, but customers can still protect themselves:

• Turn on transaction alerts for every bank, UPI and wallet app.
• If you see a transaction you didn't make, call 1930 immediately and report at cybercrime.gov.in. Here's our step-by-step complaint guide.
• Never share OTPs or approve unknown UPI collect requests. Read our guide to UPI scams in India.

FAQ

What is CRAFTY FALCON?

It's the name CERT-In uses for a threat group attacking Indian crypto exchanges, NBFCs and fintech payment platforms, as described in its November 4, 2026 critical advisory.

Which AI tools does it use?

CERT-In names PentAGI and CyberStrikeAI, which can run attack sequences autonomously.

Why do attackers send ₹1 first?

To check that a payment path works without raising alarms, before sending larger amounts the same way.

Were customer accounts hacked?

The advisories describe attacks on company systems and payment APIs. They don't say customer passwords were stolen, and they don't name affected firms.

Is this only a problem for big companies?

No. Smaller fintechs and NBFCs with fewer security staff are attractive targets, especially on holidays.

Where can I read the official advisory?

Check CERT-In's website (cert-in.org.in) for advisories. Some sector advisories go only to regulated entities.

Sources: Elets BFSI report on the CERT-In CRAFTY FALCON advisory (November 5, 2026) and Free Press Journal/ANI report on the I4C and CERT-In warning to banks and fintechs (November 5, 2026). Checked on November 12, 2026.