On 4 November 2026, India’s cyber security agency, CERT-In, sent banks, lenders and fintech companies a Critical warning. The problem is a hacker group that uses AI-driven tools to quietly get into payment systems. Once inside, it doesn’t break anything. It simply tells the company’s own system to send money out. CERT-In says the attacks are still going on right now.
The Group Behind It
CERT-In’s finance team, the Computer Security Incident Response Team – Finance (CSIRT-Fin), has named the group CRAFTY FALCON. The new advisory, CIAD-2026-0058, adds to an older one from 9 October 2026. That first warning was about hackers misusing payment and disbursement systems to move money without permission.
The group has gone after NBFCs (non-banking finance companies), digital lenders, fintech firms, payment companies and crypto exchanges. Some of these firms had already fixed their problems after the first alert. The hackers hit them again.
How the Attacks Work
According to CERT-In’s advisory, the hackers use AI-driven tools and work at machine speed.
The hackers often start with a company’s test systems. These are copies used for trying out new software. CERT-In says some were open to the internet. From there, shared passwords and tokens gave the hackers a way into the real systems.
Then comes the API. Think of it as a doorway that lets one program ask another to do a job, such as sending money. The hackers used the company’s own doorway. CERT-In also saw them using changed copies of company apps.
Before a big theft, they tested the route with tiny payments. Business Standard reports that some were as low as ₹1. CERT-In adds that the attacks came on holidays, weekends and late nights, when fewer people were watching.
What Companies Are Told to Do
CERT-In wants round-the-clock monitoring, with extra staff on weekends and holidays. Test systems should stay away from real ones, and passwords and keys should never be shared between them.
A company’s servers should also check each payment on their own instead of trusting the app. A small payment to a new person, followed by a large one, should be stopped and looked at. For crypto platforms, wallet keys belong in secure hardware or offline storage, and withdrawals should need several approvals. Any firm that sees signs of this attack should report it to CERT-In.
Our Analysis
This part is our own opinion, not from the advisory. A ₹1 payment looks harmless, so nobody bothers about it. That is probably why hackers use it to test a route. It also shows why companies should watch patterns, not just single payments.
Most of the weak spots are old ones, like open test systems and shared passwords. AI tools may help hackers find them faster, but the fix is still basic security work.
The repeat attacks stand out most. They suggest a quick patch is not enough. CERT-In itself tells firms to assume hackers may still be inside, and to check this before calling a problem fixed.
Still Unanswered
The advisory does not say who is behind CRAFTY FALCON, or how much money was lost.
For now, the lesson is simple. The attacks have not stopped, and hackers return to firms that only half fixed things. Fix problems fully, keep watching, and don’t relax on holidays.
