India’s Financial Sector Faces a New Cyber Threat: I4C Warns of AI-Powered Attacks on Banks and Fintechs

India’s cybercrime and cybersecurity authorities have issued one of their strongest warnings yet to the banking and financial services sector, cautioning that cybercriminals are increasingly using artificial intelligence to automate attacks, compromise systems at machine speed, and execute unauthorised fund transfers worth crores of rupees.

The alert, issued jointly by the Indian Cyber Crime Coordination Centre (I4C) and CERT-In, comes amid a series of cyber incidents affecting banks, non-banking financial companies (NBFCs), fintech firms, payment aggregators and digital lending platforms. Authorities say the attacks are financially motivated and are being powered by AI agents capable of identifying vulnerabilities, launching attacks and exploiting payment systems far faster than traditional cybercriminal operations.

AI Is Changing the Economics of Cybercrime

According to the advisory, cybercriminals are leveraging AI agents and "agentic AI" frameworks to automate attack chains that previously required significant human effort. These systems can rapidly identify weaknesses, generate attack scripts, adapt to changing environments and execute fraudulent transactions at machine speed.

The National Cybercrime Threat Analysis Unit (NCTAU), operating under I4C, noted that several cases have already involved multi-crore unauthorised transactions through automated fund disbursement systems and payment APIs.

Unlike conventional cyberattacks, AI-enabled attacks can significantly reduce the time between system compromise and financial theft, limiting the window available for institutions to detect and stop fraudulent activity.

How the Attacks Work

The advisory outlines a pattern that has emerged across multiple incidents.

Attackers first gain entry by exploiting unpatched software, misconfigured internet-facing servers, vulnerable IT infrastructure, or even customer-facing complaint and support systems. Once inside, they target automated payment infrastructure, particularly application programming interfaces (APIs) used for fund transfers, loan disbursements and settlement functions.

Authorities say the attack chain generally follows four stages:

• Compromise vulnerable systems through software flaws or configuration weaknesses.
• Gain access to payment and fund disbursement APIs.
• Transfer money into criminal "mule" accounts across multiple banks.
• Delete logs and evidence to hinder investigation and recovery efforts.

The stolen funds are often moved rapidly through IMPS and NEFT channels, making recovery increasingly difficult.

The Emergence of “Crafty Falcon”

CERT-In's Computer Security Incident Response Team for Finance (CSIRT-Fin) has assigned the designation CRAFTY FALCON to an AI-assisted threat actor believed to be responsible for the ongoing campaign. Authorities describe the actor as capable of surveying targets using machine intelligence and exploiting victims' own payment infrastructure against them.

CERT-In's investigation found evidence that the campaign is active and escalating, with continued reports of successful attacks even against organisations that had previously received warnings and undertaken remediation efforts. Some victims were reportedly re-targeted after incomplete remediation measures, while attacks were often timed to coincide with weekends, holidays and other periods of lower monitoring activity.

AI Tools Being Used by Attackers

CERT-In's analysis found that threat actors are using publicly available AI-based offensive security tools to accelerate attacks. The advisory specifically identified:

• ARTEX family of large language model-based offensive tools
• PentAGI autonomous multi-agent penetration testing system
• Cairn attack search engine
• CyberStrikeAI framework

According to CERT-In, these tools can autonomously execute attack chains, generate customised attack scripts and adapt exploit techniques based on target responses.

Investigators also discovered that attackers have:

• Targeted cloud infrastructure and serverless services.
• Exploited shared credentials and access tokens.
• Reverse-engineered application code to build customised exploits.
• Conducted small-value test transactions before launching larger thefts.
• Bypassed IP allow-listing protections using third-party infrastructure.

Why APIs Have Become the Primary Battleground

A recurring theme in recent regulatory and cybersecurity warnings is the vulnerability of APIs that connect banks with fintech companies and NBFCs.

The Reserve Bank of India (RBI) has recently intensified scrutiny of API security, asking banks to demonstrate compliance with cybersecurity requirements and assess weaknesses in their API ecosystems.

Reuters reported that the RBI has expressed concern over AI-driven attacks on financial infrastructure and sought details about institutions' preparedness for AI-related risks.

Regulators are particularly concerned because APIs serve as critical communication links between banks, fintech platforms and lending institutions. Any weakness in these connections could potentially enable attackers to manipulate payment instructions or move funds fraudulently.

Recent Incidents Raise Alarm

The warnings come amid several high-profile incidents across India's financial ecosystem.

Reuters reported that data belonging to approximately 3,900 customers was leaked from State Bank of India (SBI), the country's largest lender.

Separately, two Mumbai-based NBFCs reportedly suffered over 700 unauthorised transfers worth roughly $2 million after attackers allegedly compromised an API link used for loan disbursal instructions.

These incidents have reinforced concerns that attackers increasingly view smaller lenders, fintech firms and third-party vendors as softer entry points into the financial ecosystem.

What Financial Institutions Have Been Told to Do

The advisory directs banks, NBFCs, fintechs, payment aggregators and payment gateways to urgently implement protections outlined in CERT-In's critical advisories issued in October 2026.

Authorities also recommended several additional safeguards:

• Maintain a complete inventory of payment-related APIs.
• Disable obsolete, unused and test interfaces.
• Introduce daily and per-transaction limits.
• Verify beneficiary names before transfers.
• Monitor unusual transaction velocity and volumes.
• Improve coordination between security operations, transaction monitoring teams and IT departments.
• Implement continuous monitoring and heightened vigilance.

Financial institutions have additionally been instructed to:

• Report cyber incidents to CERT-In within six hours of detection.
• Report incidents to the RBI through the DAKSH portal.
• Coordinate with I4C for rapid freezing of fraudulent transactions where required.

A Wider Regulatory Push on AI Risk

The warning forms part of a broader regulatory effort to address AI-related risks in the financial system.

Earlier this year, the RBI proposed new guidelines requiring banks to establish board-approved risk management frameworks covering AI and machine learning models, including independent validation requirements and stronger governance controls. For generative AI systems that interact with customers, the RBI proposed additional cybersecurity safeguards and human oversight mechanisms.

At the same time, regulators in the United States, United Kingdom and other jurisdictions are stepping up efforts to manage AI-related risks as AI capabilities become increasingly integrated into both financial services and cybercrime operations.

The Bigger Picture

The I4C and CERT-In advisories signal a significant shift in India's cybersecurity landscape. Financial institutions have long faced cyber threats, but the emergence of AI-assisted attack frameworks is changing both the scale and speed of attacks.

Rather than simply helping hackers write malicious code, AI is increasingly being used to automate reconnaissance, adapt attacks in real time, exploit APIs, evade detection and accelerate money movement through financial systems. Authorities now view these capabilities as an immediate operational risk rather than a future concern.

For India's banks, fintechs and NBFCs, the message from regulators is clear: AI-powered cyberattacks are no longer theoretical. They are active, financially motivated and already being used in attempts to compromise financial infrastructure and move funds at machine speed.