India's financial institutions are facing an evolving cybersecurity threat as hackers increasingly use artificial intelligence to automate attacks and exploit weaknesses in digital payment systems. The Indian Computer Emergency Response Team (CERT-In) has warned about a campaign in which attackers use transactions as small as ₹1 to test payment routes before attempting larger unauthorised transfers.

AdvertisementThe Puranic

Identified as CRAFTY FALCON, the campaign has been classified by CERT-In as an active and ongoing threat. In its November 4 advisory, the agency warned that the attacks are targeting different parts of India's banking, financial services and insurance (BFSI) sector.

According to the advisory, attackers are using publicly available AI-driven tools, including ARTEX, PentAGI, Cairn and CyberStrikeAI, to automate different stages of cyber intrusions. These tools can generate customised scripts, modify malicious payloads and adapt their activities based on how targeted systems respond.

The attackers have reportedly exploited cloud management services, exposed testing environments, shared credentials and application vulnerabilities to gain access to financial systems. They have also attempted unauthorised API calls and targeted merchant settlement systems and cryptocurrency wallets.

CERT-In has advised financial institutions to strengthen continuous security monitoring, separate testing environments from production systems and address vulnerabilities promptly.

The agency has also recommended flagging small-value test transactions to new beneficiaries when followed by larger transfers, introducing cooling periods for newly added beneficiaries and monitoring unauthorised AI tools and large language model API usage.

The warning highlights the growing need for financial institutions to strengthen payment security as cybercriminals adopt increasingly automated attack methods.