India’s Cyber Agency Issues a Critical Alert
On 9 October 2026, India’s Computer Emergency Response Team (CERT-In) issued a critical advisory about a payment API attack on financial companies. API stands for application programming interface, the connection that lets one piece of software talk to another, including software that sends money. According to the advisory, attackers do not need to break a customer-facing app. They steal the credentials that the payment system itself uses and then instruct it to move the money.
How the Attack Works
CERT-In and CSIRT-Fin, India’s financial-sector response team, say they have seen several campaigns against non-banking financial companies (NBFCs), digital lending platforms, fintech firms, payment service providers and wallet operators, so the targets are not only large banks. Attackers steal payment gateway and partner-bank API credentials, then call the fund-transfer APIs from the victim’s own whitelisted systems. This skips application-level checks such as know your customer (KYC) verification, sanction screening, beneficiary verification, balance checks and per-transaction limits. The transactions carry dummy reference numbers and send money to mule accounts across several banks, meaning accounts used to pass on stolen funds, over the Immediate Payment Service (IMPS) and National Electronic Funds Transfer (NEFT) systems.
Where the Attackers Get In
CERT-In lists the entry points: exposed internet-facing applications, deprecated or unauthenticated APIs, long-lived static API tokens hard-coded in source code, plaintext credentials in configuration files, forged commits in code repositories, and remote services without multi-factor authentication (MFA). Attackers then delete logs and tamper with endpoint detection and response (EDR) tools. The advisory also says its analysis indicates possible use of AI-assisted offensive tooling, with the gap between first compromise and fraudulent transfer shrinking in recent incidents. It does not name any tool or attacker.
Why the Last Step Is the Weak Spot
The advisory’s own fix list offers a clue. It asks firms to cryptographically bind multi-step transaction flows so a debit API cannot be called without earlier validation, and to reject payouts whose reference numbers match no record. That suggests some firms check identity and limits earlier in the workflow but not at the final payment call. This is our reading of the advisory, not a finding stated in it. If it holds, anyone with valid credentials and access to a trusted server can skip every earlier check, which explains why the customer-facing app never needs to be touched.
Related Cases in India and South Korea
A recent Indian case shows the cash-out side. In a Press Trust of India (PTI) report published by ThePrint on 16 September, Delhi Police said it had arrested five people, including a bank relationship manager, over Rs 12.84 crore taken from an NBFC’s corporate account through 317 unauthorised transactions routed into 34 primary-layer bank accounts. The Statesman names the victim as Hero FinCorp Ltd and reports that police placed a hold on about Rs 1.7 crore. The reports I reviewed do not say how the account was accessed, and nothing links the case to CERT-In’s advisory. It shows the same mule-account pattern, nothing more.
South Korea shows a similar weak spot from another angle. PYMNTS, citing the Financial Times, reported on 6 October that President Lee Jae Myung said hacks exposed user data at seven financial firms, with signs of AI use in some cases. The hackers reportedly targeted less secure third-party systems instead of core payment networks, including a loan-broker portal that exposed about 25,000 Shinhan Bank customers. No money had been reported stolen.
What Companies and Customers Should Do
CERT-In tells firms to enforce MFA on payment platforms and remote access, keep a complete API inventory, retire unused APIs, and replace long-lived static tokens with per-session authentication. It also wants second-level (maker-checker) approval for fund movement, per-transaction and daily limits, real-time monitoring, and logs kept for at least 180 days. On suspicious activity, firms should disable compromised accounts, suspend affected APIs, rotate credentials, preserve evidence and report to CERT-In.
For ordinary customers, Dainik Jagran English reports that anyone who notices an unauthorised transaction should contact their bank or payment provider immediately and report it through official channels.
