NEW DELHI — India’s national cybersecurity response agency has warned financial institutions about an active hacking campaign that uses artificial intelligence tools to help automate attacks, according to Reuters reporting on November 5. The advisory raises concerns for nonbank lenders, financial technology businesses and cryptocurrency exchanges, but officials have not publicly identified the attackers or established that a foreign government directed the campaign.
The Indian Computer Emergency Response Team, known as CERT-In, refers to the activity as Crafty Falcon. The agency says attackers have sought access to payment and disbursement systems, with activity timed in some cases for weekends and holidays when security teams may be smaller. The alert does not establish that every institution in those sectors has been compromised.
The warning identifies several tools used in the reported activity, including ARTEX, PentAGI, Cairn and CyberStrikeAI. Some researchers have associated certain tools with China-linked activity in other incidents. That is not the same as proof that the people behind this campaign are Chinese, or that China’s government sponsored it. CERT-In did not make either claim, according to the reporting.
Artificial intelligence can change the speed and scale of cyberattacks without changing their basic objectives. Attackers still need a way into a network, such as compromised credentials, an exposed service or a software weakness. Automation may help them scan for openings, organize stolen information or move through systems faster than a small security team can respond.
Financial firms face an especially difficult combination of risks because digital access and rapid payments are central to their business. A compromised administrative account may expose customer information, while unauthorized access to a payment workflow can create immediate financial losses. Security controls that prevent one compromised account from authorizing a large transfer can reduce the impact even when an attacker gets inside.
Reuters noted other recent incidents involving Indian lenders and financial institutions, including unauthorized transfers and customer-data concerns. The agency did not confirm that those incidents were connected to Crafty Falcon. Treating separate incidents as a single coordinated operation without evidence would exaggerate what investigators currently know.
The timing of the advisory is important for financial customers and companies beyond India. Payment technology, outsourced development and cross-border financial services connect Indian businesses with institutions around the world, including in the United States. An alert aimed at Indian firms can therefore prompt American partners to review their own access controls and the security assurances of vendors.
Practical safeguards include multifactor authentication for privileged accounts, approval requirements for large transfers, logging that cannot be easily erased, and monitoring during holidays. Companies should also rehearse how to isolate compromised systems without disrupting legitimate customer transactions. These are general risk-reduction steps, not a claim that any particular product or control would have stopped the reported campaign.
For consumers, the warning is not a reason to assume their money has been stolen. People should use official bank channels to check unexpected transactions and report suspicious activity promptly. Firms that discover a breach should provide clear, evidence-based notifications rather than speculate about the perpetrators.
The central unanswered questions are who is operating Crafty Falcon, which organizations have been affected and how much damage, if any, can be directly attributed to it. Until investigators publish those findings, the most defensible conclusion is that India’s cyber agency has identified a serious threat requiring attention, not that it has proved an international state-backed conspiracy.
Source and reporting credit
Original reporting and factual reference: Reuters, November 5, 2026. This article is independently written and does not reproduce the source report.
