India’s cybersecurity agency has warned that an AI-assisted hacking campaign is targeting cryptocurrency exchanges, lenders and payment companies, exploiting legitimate financial systems to steal funds. The November 4 alert identifies an active threat actor called CRAFTY FALCON.
CERT-In Reports Escalating Attacks
According to the Indian Computer Emergency Response Team (CERT-In), advisory CIAD-2026-0058 updated an October 9 warning after investigators detected continued breaches, including at organizations that had already attempted remediation.
“The threat is active and ongoing,” CERT-In said, adding that its financial incident response team continues receiving reports of successful attacks.
Affected sectors include non-banking financial companies, digital lenders, payment aggregators, fintech providers and virtual digital asset businesses. The agency has not identified compromised exchanges or disclosed aggregate financial losses.
AI Tools Accelerate Intrusions
CERT-In described the attacker as operating at ‘machine speed,’ using automated reconnaissance and rapidly adapting malicious scripts. According to the advisory, tools associated with the campaign include ARTEX, PentAGI, Cairn, and CyberStrikeAI. These systems can assist with identifying weaknesses, modifying attack techniques and producing tailored payloads.
Attackers reportedly exploited exposed testing environments, then accessed production systems through shared credentials and tokens. They also misused cloud administration services and modified application packages to issue unauthorised API requests.
Small Transfers Precede Larger Theft
Investigators observed attackers initiating transactions as small as Rs. 1 to verify that illicit transfers worked before attempting larger withdrawals.
Other techniques involved manipulating merchant settlement APIs, routing requests through third-party services and stealing cryptocurrency wallet keys. Some intrusions occurred during weekends or holidays, when security monitoring could be reduced.
Financial Firms Urged to Strengthen Defences
CERT-In advised organizations to ‘treat this campaign as active and escalating,’ maintain continuous monitoring and strengthen staffing during vulnerable periods. Security teams should examine exposed development systems, restrict production credentials, monitor unusual API activity and review cloud permissions.
The warning highlights how AI-assisted attacks can exploit ordinary financial infrastructure rather than relying exclusively on sophisticated malware. For cryptocurrency exchanges, protecting wallet credentials and detecting abnormal transfers remain essential to limiting losses.
Also Read: Andhra Pradesh CID Traces Rs. 15 Crore Crypto Fraud, Court Orders Victim Refund
Disclaimer : Crypto News India does not recommend that any cryptocurrency should be bought, sold, or held by you. Do conduct your own due diligence and consult your financial advisor before making any investment decisions.
