India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has identified an active hacking campaign targeting non-banking financial companies, fintech businesses and cryptocurrency exchanges. The campaign, reportedly known as "Crafty Falcon", uses publicly available artificial intelligence tools to automate cyberattacks and exploit vulnerabilities in financial systems.

According to the agency's latest advisory, attackers are using AI-powered tools to break into systems at high speed and manipulate payment and fund-disbursement infrastructure. The warning has raised fresh concerns about the growing use of artificial intelligence in financial cybercrime.

Four AI Hacking Tools Identified by CERT-In

CERT-In has identified four tools allegedly being used in the campaign:

• ARTEX

• PentAGI

• Cairn

• CyberStrikeAI

Security researchers have linked at least two of these tools to China. However, CERT-In has not identified the individuals or organisations operating the hacking campaign, and it has not confirmed any state sponsorship.

ARTEX has previously been associated with cyberattacks targeting South Korean banks. Researchers have also linked its use to an espionage campaign targeting more than 200 organisations across at least 14 countries.

The tools are publicly available, making the situation particularly concerning for organisations that may not have sufficient cybersecurity protection.

How Are Hackers Using AI to Target Financial Companies?

The attackers reportedly use AI tools to identify weaknesses in an organisation's digital infrastructure and automate parts of the intrusion process.

Once access is gained, they can exploit payment interfaces and fund-disbursement systems to move money through the victim's own infrastructure.

Application Programming Interfaces (APIs) are particularly important in this process. These software connections allow banks, lenders and fintech platforms to communicate and exchange payment instructions.

If attackers compromise these connections, they may be able to manipulate transactions or initiate unauthorised fund transfers.

CERT-In has also warned that the attackers deliberately target weekends, holidays and other periods when security teams may be less active. This can delay the detection of suspicious activity.

Recent Cybersecurity Incidents Raise More Concerns

The latest warning comes amid several cybersecurity incidents involving Indian financial institutions.

Two Mumbai-based non-banking lenders reportedly suffered unauthorised instant transfers worth approximately $2 million across more than 700 transactions in October. The incident involved payment interfaces connected to ICICI Bank.

State Bank of India also disclosed a dark-web leak involving 3,897 customer records.

Separately, Spandana Sphoorty Financial reported unauthorised debits from a bank account, while AU Small Finance Bank said it was investigating a potential customer-data leak.

However, CERT-In has not confirmed whether these individual incidents were directly connected to the Crafty Falcon campaign.

Why Are AI-Powered Cyberattacks More Dangerous?

Traditional cyberattacks often require considerable manual effort to identify vulnerabilities, test systems and execute malicious activities.

AI-powered tools can automate several of these steps, allowing attackers to work faster and potentially target multiple organisations simultaneously.

The biggest concern is that automated attacks can exploit weaknesses before organisations have enough time to identify and fix them.

CERT-In has also highlighted cases in which organisations were attacked again because earlier security fixes were incomplete.

This makes regular security assessments and proper vulnerability management increasingly important.

What Should Banks and Fintech Companies Do?

Financial institutions need to strengthen their cybersecurity systems to reduce the risk of AI-assisted attacks.

Some important precautions include:

• Regularly audit APIs and payment gateways for security weaknesses.

• Install software updates and security patches without delay.

• Monitor unusual transactions and suspicious fund transfers.

• Introduce transaction limits and additional verification for sensitive payments.

• Maintain continuous monitoring, particularly during weekends and holidays.

• Conduct regular cybersecurity assessments and incident-response exercises.

• Ensure that security fixes completely address previously identified vulnerabilities.

AI Is Creating New Opportunities as Well as Cybersecurity Risks

Artificial intelligence is helping financial companies improve customer service, detect fraud and automate operations. However, the same technology can also be misused by cybercriminals to make attacks faster and more sophisticated.

The latest CERT-In warning highlights why cybersecurity can no longer depend only on traditional protection systems.

As banks, fintech platforms and digital payment services become increasingly interconnected, organisations will need stronger monitoring, faster incident response and regular security testing to protect customer information and financial transactions.