India names the AI tools behind a hacking campaign against its banks
CERT-In calls the threat “active and ongoing” as a group it calls Crafty Falcon turns public AI tools against lenders, fintech firms and crypto exchanges; and at least two of those tools trace back to China.
Published 5 November 2026 · 10:06 GMT
The summary
India’s cybersecurity agency CERT-In issued advisory CIAD-2026-0058 on Wednesday 4 November 2026, rated Critical, naming the threat actor behind an escalating AI-driven campaign against financial firms as “Crafty Falcon” and calling the threat “active and ongoing”. The attackers use four publicly available AI-driven offensive security tools, the ARTEX family, PentAGI, Cairn and CyberStrikeAI, to automate whole attack chains at machine speed.
The three lenses
- WestWestern coverage leads with the China connection and treats the advisory as the latest evidence that AI tools built for security testing are being turned against the financial system at scale.
- EastFrom East Asia the story reads less like a warning about the future and more like a sequel, because the same toolset has already been used against the region’s own banks.
- Global SouthIndian coverage treats the advisory as a domestic emergency with a bureaucratic paper trail, and it reads the campaign through the institutions that have been warning about it for a month.
Key facts
- India’s cybersecurity agency CERT-In issued advisory CIAD-2026-0058 on Wednesday 4 November 2026, rated Critical, naming the threat actor behind an escalating AI-driven campaign against financial firms as “Crafty Falcon” and calling the threat “active and ongoing”. CERT-In Advisory CIAD-2026-0058 (4 Nov 2026)
- The attackers use four publicly available AI-driven offensive security tools, the ARTEX family, PentAGI, Cairn and CyberStrikeAI, to automate whole attack chains at machine speed. Reuters (5 Nov 2026)
- Crafty Falcon moves money by invoking the victim’s own payment and disbursement interfaces, after testing the route with micro-value transactions as small as one rupee. The Indian Express (5 Nov 2026)
- Security researchers have linked at least two of the four tools to China, and the China-made ARTEX tool was used in attacks on South Korean banks from late September, according to CrowdStrike. Reuters (5 Nov 2026)
- CERT-In did not say who is behind the breaches or where the organisation operates, did not name the affected companies, and did not say how much money was stolen. Reuters (5 Nov 2026)
What did India’s cyber agency actually warn about?
India’s cybersecurity agency has put the country’s financial sector on its highest alert, warning that an artificial-intelligence-assisted hacking campaign is actively moving money out of lenders, fintech firms and cryptocurrency exchanges, and that the attacks are still under way. The Indian Computer Emergency Response Team, known as CERT-In, issued the warning on Wednesday 4 November in an advisory rated Critical, and it named the campaign Crafty Falcon and the four publicly available AI tools behind it. The advisory, numbered CIAD-2026-0058, updates an earlier CERT-In warning from 9 October, and it says the campaign has escalated since then. CERT-In said the attackers survey their targets with machine intelligence, operate at machine speed and strike by invoking the victim’s own payment and disbursement systems, which turns the plumbing of modern finance into the weapon itself.
What do the advisories establish so far?
The picture CERT-In paints is unusually detailed for a public warning, because the agency is describing a method rather than a single incident. The attackers use four publicly available AI-driven offensive security tools, ARTEX, PentAGI, Cairn and CyberStrikeAI, to run whole attack chains on their own, generating and refining tailored attack scripts in rapid succession. They probe cloud infrastructure and slip from exposed test environments into live production systems using shared credentials. The money moves in a pattern the advisories describe with clinical precision: before attempting a large transfer, the attackers send micro-value test transactions, sometimes as little as one rupee, to check that an unauthorised payment route works, and only then do they push larger sums through the victim’s own payment interfaces, routing the money to mule accounts spread across multiple banks. The attacks are timed to coincide with holidays, weekends and other low-monitoring windows, firms that patched their systems after the October warnings have been attacked again because the remediation was incomplete, and firms must now report incidents within six hours.
What remains unproven about Crafty Falcon?
For all the detail in the advisories, the most consequential questions have no public answer yet. CERT-In has not said who is behind Crafty Falcon or where the organisation operates, it has not named any of the affected companies, and it has not said how much money has been stolen, which means the scale of the losses is still a blank in the public record even as the method is laid out in full. The agency has also not said which recent incidents in Indian finance belong to this campaign, and that distinction matters, because Reuters reported separately that two Mumbai-based non-bank lenders lost about two million dollars in more than 700 unauthorised instant transfers from ICICI Bank accounts on 8 and 9 October,; yet CERT-In connected neither incident to Crafty Falcon. The China question is the sharpest unknown: researchers have linked at least two of the four tools to China, and ARTEX is a China-made tool that CrowdStrike says was used against South Korean banks from late September, yet CERT-In made no attribution, so the tools have a provenance while the campaign does not.
Why does an AI-assisted heist change the stakes for every bank?
This campaign matters beyond India because it shows what happens when the most powerful new capability in computing, an AI agent that can plan, probe and adapt on its own, is handed to people whose only goal is to move other people’s money, and the result is an attack that runs at a speed no human team can match. Crafty Falcon’s method needs none of that: the tools survey the target, write the attack, test the payment route with a one-rupee probe and push the real transfer through the bank’s own systems while the defenders are at their thinnest on a holiday weekend. That is why the warning lands as a sector-wide alert, since the vulnerability is the shared plumbing every lender relies on. The timing sharpens it further, because the advisory arrived on 4 November, four days before Diwali falls on Sunday 8 November, which is both a festival and a weekend, a low-monitoring window the attackers favour, though CERT-In did not name the festival. India’s financial sector is also one of the largest and fastest-digitising in the world; and the Mumbai trading debut of Ambani’s Jio underlined how deep the country’s capital markets now run; so a method that turns those instant rails against their owners carries systemic weight.
How did a public testing tool become a bank robber’s kit?
The uncomfortable truth at the centre of this story is that nothing in the Crafty Falcon toolkit was built for crime, because ARTEX, PentAGI, Cairn and CyberStrikeAI were all built as offensive security tools, programs that test a company’s defences by attacking them, so that the defenders can find the holes first, and the campaign works precisely because those tools are good at their legitimate job. An AI penetration-testing agent does what a hired tester does, only faster and without sleep, and when that capability is pointed at a bank’s payment interfaces instead of its defences, the same loop becomes a robbery that tests its own escape route with a one-rupee transfer before committing to the real theft. The tools were free online, the models are commercial services, and the infrastructure is rented cloud capacity, so the barrier to entry has collapsed from a skilled team to anyone who can download a public tool. That collapse explains why the advisories keep coming back to the same unglamorous defences, separate the test systems from the live ones, guard the cloud consoles, watch the small transfers, and finish the remediation properly, and the same week showed how the cost of living decided the 2026 midterms.
What happens when the tools of defence become the tools of attack?
The second-order effects will reach well beyond the firms that were breached, because the first consequence is regulatory, and it is already visible. New AI security auditing guidelines from CERT-In, and the six-hour incident-reporting rule combined with the Reserve Bank’s tightened checks, point toward a regime in which banks must show which AI tools run on their networks. The second consequence is commercial, since insurers, auditors and counterparties will start pricing the risk that a lender’s payment interfaces can be turned against it, and recent weeks have shown how fast markets move on a single signal, so firms without clean separation between test and production will pay more. The third consequence is geopolitical: a campaign using China-made tools against Indian banks, weeks after the same tools hit South Korean and Japanese firms, will feed the argument in every capital that AI security tools need export controls and provenance rules, though the tools are open-source and the campaign is unattributed.
What should banks and regulators do before the next holiday weekend?
The immediate next steps are set out in the advisories themselves, and they are strikingly concrete for a government warning. Financial firms are told to run round-the-clock monitoring with more staff and lower alert thresholds over holidays and weekends, to eradicate intrusions forensically, to restrict cloud access, to separate testing from production, and to flag one-rupee test transactions to new beneficiaries followed by larger transfers, with cooling-off periods and monitoring of unauthorised AI tools. Crypto platforms must store wallet keys in hardware modules or cold custody and require multi-signature withdrawals, while all firms must report incidents within six hours. Beyond the checklist, the full indicators of compromise have been shared with financial institutions in a restricted version of the advisory, so disclosures from affected lenders will show how much Crafty Falcon has taken, and the Diwali weekend will test whether the warnings changed behaviour.
The three lenses
West Lens:
Western coverage leads with the China connection and treats the advisory as the latest evidence that AI tools built for security testing are being turned against the financial system at scale. Reuters, which broke the story from Bengaluru and Mumbai, frames India as joining a growing list of countries where such tools have been used against banks, and it anchors the China link in CrowdStrike’s findings on ARTEX and a China-linked espionage campaign against more than 200 organisations.
East Lens:
From East Asia the story reads less like a warning about the future and more like a sequel, because the same toolset has already been used against the region’s own banks. In South Korea, attackers used ARTEX from 27 September into early October against seven financial institutions, Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital, exfiltrating data on roughly 67,000 people, and CrowdStrike found the attackers’ working notes in open directories.
South Lens:
Indian coverage treats the advisory as a domestic emergency with a bureaucratic paper trail, and it reads the campaign through the institutions that have been warning about it for a month. The Indian Express places the 4 November advisory in a sequence that began with CERT-In’s 9 October warning, while The Economic Times sets out the machinery of the response, the home ministry’s warning, the Reserve Bank’s checks, and the six-hour rule, and Business Today zeroes in on the one-rupee test transactions, The tone is practical rather than geopolitical, and the emphasis falls on what firms must do next: round-the-clock monitoring, separating test environments from production, flagging small test transfers to new beneficiaries, cooling-off periods, and watching for unauthorised AI tools on their own networks.
The consensus
- What we agree on
- What we agree on: CERT-In issued a Critical advisory on 4 November 2026 naming an AI-assisted threat actor, Crafty Falcon, that is actively attacking India’s financial firms with four publicly available AI tools, ARTEX, PentAGI, Cairn and CyberStrikeAI, and moving money through the victims’ own payment and disbursement interfaces, with the threat described as active and ongoing.
- What we don't agree on
- What we disagree on: whether the China link in the tooling amounts to evidence about who runs the campaign, since researchers have linked at least two tools to China while CERT-In itself made no attribution and the tools were freely available; and whether this is primarily a criminal money-making operation or something with a state dimension, a question the public evidence does not settle.
- What we know
- What we know: the advisory number and date, the four tools, the target set across non-bank lenders, fintech firms, payment providers and crypto exchanges, the one-rupee test-transaction method, the holiday and weekend timing, the re-targeting of firms after incomplete remediation, and the Korean precedent in which the same toolset hit seven financial institutions from late September.
- What we don't know yet
- What we don't know: who operates Crafty Falcon, where the group is based, which Indian firms were hit and how much was taken, which of the recent incidents in Indian finance belong to this campaign, and whether the campaign will spread beyond India’s financial sector.
- What we expect
- What we expect: firms to tighten monitoring through the Diwali weekend, incident reports to surface within the six-hour rule, disclosures from affected lenders or exchanges to establish the scale of the losses, and regulators in India, South Korea and Japan to keep converging on guidance for AI tools on financial networks.
Questions, answered
What is Crafty Falcon?
Crafty Falcon is the name CERT-In’s finance-sector response team, CSIRT-Fin, gave to the threat actor behind an escalating campaign of AI-assisted attacks on India’s banks, non-bank lenders, fintech firms and crypto exchanges. The agency designated the actor in its Critical advisory of 4 November 2026 and described the threat as active and ongoing, with firms still reporting successful attacks.
Which AI tools did CERT-In name?
The advisory names four publicly available, AI-driven offensive security tools: the ARTEX family of large-language-model tools, the PentAGI autonomous multi-agent penetration-testing system, the Cairn attack search engine and the CyberStrikeAI framework. All four were built for security testing, and all four were freely available online, which is why the campaign could be mounted without bespoke malware.
How do the attackers move money?
They turn the victim’s own systems against it. After surveying the target with machine intelligence, they invoke the victim’s payment and disbursement interfaces to push unauthorised transfers, first testing the route with micro-value transactions as small as one rupee, then moving larger sums to mule accounts across multiple banks through instant and electronic transfer rails.
Is China behind the attacks?
That has not been established. Security researchers have linked at least two of the four tools to China, and the China-made ARTEX tool was used against South Korean banks from late September, but CERT-In did not say who is behind the breaches, did not call the attacks state-sponsored, and noted that the tools were freely available. The tools have a provenance, while the campaign itself does not yet have an attribution.
What should Indian financial firms do now?
CERT-In’s guidance is concrete: run round-the-clock monitoring with more staff and lower alert thresholds over holidays and weekends, separate test environments from production, restrict cloud access, flag one-rupee test transfers to new beneficiaries followed by larger ones, add cooling-off periods for new payees, watch for unauthorised AI tools, store crypto wallet keys in hardware modules, and report any incident within six hours.
Sources
- CERT-In Advisory CIAD-2026-0058 (4 Nov 2026)
- Reuters (5 Nov 2026)
- The Indian Express (5 Nov 2026)