AI-Assisted Attackers Keep Hitting Indian Fintechs, Striking on Weekends and Returning After Failed Clean-ups

India's Computer Emergency Response Team (CERT-IN) has warned the country's financial services sector of a "significant escalation" in attacks by what it calls an "AI-assisted financial threat actor", now named CRAFTY FALCON. First detected in October, the attacks target digital lending platforms, fintechs, payment providers and wallet operators. The group goes after internet-facing applications, exposed APIs and privileged endpoints, and tries to use payment APIs to steal money.

According to CERT-IN's Thursday update, the same organisations have been deliberately targeted again, including after incomplete clean-up efforts. Attacks have also been timed for holidays, weekends and other periods when monitoring is light, to delay detection and response. The group looks for exposed testing or development environments, where it finds shared credentials, tokens or network paths that lead into production systems. Once inside, it rewrites applications so they make unauthorised API calls. Because defences assume only legitimate apps call those APIs, the activity may not be flagged.

CERT-IN says the group uses AI-enhanced tools, including ARTEX, Cairn and CyberStrikeAI, which have been linked to users who appear to speak Chinese. It also produces many functionally identical variants in quick succession, a pattern consistent with AI-generated code, and quickly exploits newly found vulnerabilities. This article is based on the opening of the original report and does not cover the full story.