India Warns of 'Crafty Falcon': AI-Assisted Attackers Hitting Finance and Crypto Firms Again and Again

India's national cyber agency, CERT-In, published an advisory on November 4 about a previously undocumented threat actor named Crafty Falcon. The group uses AI and agentic AI penetration testing tools, including some previously linked to Chinese hacking groups, against non-banking financial companies. Targets include digital lending platforms, fintech firms, payment providers and cryptocurrency exchanges. Some had already received a restricted advisory in early October about attackers abusing payment and disbursement APIs to make unauthorised transfers. They were attacked again, and CERT-In pointed to "incomplete remediation". Attacks were typically seen during holidays, weekends and other low-monitoring windows.

According to CERT-In's finance branch, the actor usually gets in through internet-exposed testing environments, such as user acceptance testing and staging systems. From there it moves into live production systems by exploiting shared credentials, authentication tokens or network paths between the two. It also studies an organisation's application code to build tailored exploits, then uses modified application packages to make unauthorised API calls. This defeats controls that assume only the genuine app will talk to the API.

The group also gets around IP allow-listing by routing traffic through trusted third-party services, such as content-acceleration tools and app-store review fetchers, which anyone on the internet can direct to fetch web addresses. That lets its traffic appear to come from addresses the victim already trusts.