CRAFTY FALCON: AI-assisted actor targets Indian fintech payment APIs, re-targets after incomplete fixes
Severity: high · Patch status: unknown · Since 2026-11-05
India's CERT-In, in advisory CIAD-2026-0046 and its update CIAD-2026-0058 published on 5 November 2026, warns of active and escalating attacks by an actor it names CRAFTY FALCON, first observed in October 2026, which it describes as AI-assisted. The targets it reports are Indian digital lenders, fintech apps, payment providers and wallet operators, with banking and insurance entities also mentioned. Per The Register's account of the advisory, the actor enters through internet-exposed test and development environments, harvests shared credentials, tokens and network paths, moves into production, and rewrites victim applications to make unauthorised payment API calls. The Register adds, without naming a source, that the actor tests with payments of about $0.01 before larger transfers and that it steals wallet keys from crypto exchanges and virtual asset providers. CERT-In says attacks are timed for weekends and holidays, that victims have been re-targeted after incomplete remediation, and that code variants are refined in rapid succession and show a pattern consistent with AI-generated code. It names ARTEX, Cairn and CyberStrikeAI as tools the actor uses. No victim count, CVE or vendor product is given, and no fix is identified because the actor exploits newly discovered flaws. CERT-In's recommendations are 24x7 real-time monitoring with alerting, keeping test environments off the internet, restricting cloud access and improving logging.
What to do
- Enable real-time anomaly monitoring, comprehensive logging and alerting with 24x7 coverage, especially across weekends and holidays
- Take test and development environments off the internet and restrict access to cloud resources
- Rotate shared credentials and tokens found in non-production systems and audit network paths from test to production
- Review payment API call patterns for unauthorized or anomalous transfers, including micro-transactions around $0.01
- Verify completeness of any prior remediation, as re-targeting after incomplete fixes has been observed
- Harden crypto wallet key storage and access controls at virtual asset service providers
Sources
All live incidents on Threat Watch
