Artificial intelligence is making digital payments faster and more convenient, but cybercriminals are also using the technology to make their attacks more sophisticated. In a major cybersecurity development, India's cybersecurity agency CERT-In has warned about an escalating AI-powered hacking campaign targeting financial technology companies.

The campaign, identified as 'Crafty Falcon', reportedly targets non-banking financial companies (NBFCs), digital lending platforms, payment aggregators and cryptocurrency exchanges.

The warning is particularly important as millions of Indians depend on digital platforms for loans, money transfers, investments and everyday payments.

What Is the Crafty Falcon Cyberattack?

Crafty Falcon is the name given by CERT-In's financial-sector response team to a cyberattack campaign targeting financial institutions.

According to the agency's advisory issued on November 4, attackers are using publicly available AI-powered security tools to identify weaknesses in digital systems and automate parts of their attacks.

Instead of relying entirely on traditional hacking methods, these attackers can use automated tools to examine websites, discover vulnerable systems and target exposed application programming interfaces (APIs).

The agency has described the threat as active and ongoing.

How Are Hackers Using AI to Target Financial Companies?

One of the biggest concerns is the use of AI tools to automate cyberattacks.

CERT-In has reported that attackers are exploiting vulnerabilities in payment and disbursement APIs, which are systems used by financial platforms to process transactions.

Some of the methods reportedly include:

• Identifying security weaknesses in internet-facing applications.

• Exploiting exposed payment and banking APIs.

• Targeting privileged accounts and endpoints.

• Using stolen login credentials to access systems.

• Attempting fraudulent transactions through manipulated payment requests.

The use of automation allows attackers to carry out multiple activities rapidly, potentially increasing the scale of an attack.

Why Is This Cyberattack Particularly Dangerous?

The biggest concern is that attackers are targeting the systems responsible for moving money.

If criminals gain unauthorised access to vulnerable payment infrastructure, they may attempt to manipulate transactions, bypass certain controls or redirect funds.

CERT-In has also warned that some affected organisations were targeted again after implementing incomplete security fixes.

Another worrying aspect is the timing. Attackers reportedly exploit weekends and holiday periods when monitoring teams may be less active and suspicious activity could take longer to detect.

Which AI Tools Have Been Linked to the Campaign?

According to reporting on CERT-In's advisory, the attackers have used publicly available offensive cybersecurity tools, including ARTEX, PentAGI, Cairn and CyberStrikeAI.

These tools can assist with security testing and vulnerability discovery, but their misuse can create serious risks for organisations with weak security systems.

It is important to understand that cybersecurity tools are not automatically malicious. Their purpose depends on how they are used and whether the activity is authorised.

How Can Ordinary Smartphone Users Protect Themselves?

Although the reported campaign primarily targets financial companies, customers should also follow basic digital security practices.

Here are some important precautions:

1. Never share your UPI PIN, ATM PIN, OTP or banking password with anyone.

2. Avoid clicking suspicious links received through SMS, WhatsApp or email.

3. Install banking and payment applications only from official app stores.

4. Keep your smartphone, applications and operating system updated.

5. Enable transaction notifications to identify unusual activity quickly.

6. Avoid installing unknown APK files or applications shared through messaging platforms.

7. Contact your bank immediately if you notice an unauthorised transaction.

If you experience financial cyber fraud in India, report it immediately through the national cybercrime helpline 1930 or the official portal cybercrime.gov.in.

What Should Financial Companies Do Now?

CERT-In has advised financial organisations to treat the campaign as an immediate and continuing threat.

Companies need to review their payment systems, secure exposed APIs, update vulnerable software and strengthen access controls.

They should also monitor unusual transactions, conduct regular security assessments and ensure that previous vulnerabilities have been completely fixed.

AI Is Changing the Future of Cybercrime

The Crafty Falcon campaign highlights how artificial intelligence is changing the cybersecurity landscape. Technology that helps businesses automate operations can also help criminals identify weaknesses and execute attacks more efficiently.

For India, where digital payments and online financial services are expanding rapidly, cybersecurity has become just as important as convenience.

The biggest lesson for users and businesses is simple: protecting digital money requires more than strong passwords. Regular security updates, careful monitoring and quick reporting of suspicious activity are equally important.