India's CERT-In names Crafty Falcon AI-tool hacks on lenders, fintechs and crypto exchanges
The Nov 4 advisory says attackers use ARTEX, PentAGI, Cairn and CyberStrikeAI to hit payment APIs 'at machine speed'; at least two tools are linked to China; no victim list or theft total was given.
Why it matters
CERT-In's November 4 advisory names Crafty Falcon as an AI-assisted threat against Indian non-bank lenders, fintechs and crypto exchanges. It says the group uses public tools — ARTEX, PentAGI, Cairn and CyberStrikeAI — to probe targets and drive money through victims' own payment APIs, often on weekends and holidays. CNA reports that researchers have linked at least two of the tools to China, while CERT-In did not call the campaign state-sponsored or list victims. The case shows offensive AI tooling moving from research demos into payment-rail abuse. Watch RBI follow-up guidance and whether named tools stay public.
Key facts
- CERT-In advisory dated 4 November 2026
- Group name: Crafty Falcon
- Tools: ARTEX, PentAGI, Cairn, CyberStrikeAI
- Targets: NBFCs, fintechs, crypto exchanges
- Attacks via victims' payment/disbursement APIs