CERT-In Crafty Falcon Alert: What Fintechs Must Fix Now

In short: On 4 November 2026, CERT-In issued advisory CIAD-2026-0058 about a threat actor it calls Crafty Falcon. The group uses AI-assisted tools to break into exposed test servers, move into production and misuse payment and disbursement APIs at NBFCs, fintechs, payment aggregators and crypto exchanges. CERT-In describes the campaign as active and ongoing.

Most fraud controls are built to stop a stranger taking over a customer account. This attack is different: according to the advisory, the attacker makes the company's own systems send the money. If your UAT server shares credentials with production, or your app trusts whatever the client sends, you may already have the gap this group looks for. The steps below are the practical response.

What Happened

CERT-In published the advisory, titled "Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor 'CRAFTY FALCON'", on 4 November 2026, and the official advisory page shows an update on 11 November 2026. According to reports by Infosecurity Magazine and Cyble, it follows an earlier restricted advisory in October that warned financial entities about abuse of payment APIs, and notes that some organisations were attacked again after incomplete clean-up.

The advisory names publicly available offensive AI tools seen in the attacks, including ARTEX, PentAGI, Cairn and CyberStrikeAI, which can run attack steps automatically and adjust payloads quickly. The advisory does not say how many organisations were hit, and we have not seen a confirmed attribution, so treat any claims about who is behind it with care.

How the Attacks Work

Based on the advisory as summarised by CERT-In and the reports above, the pattern is:

• Way in: internet-exposed UAT, staging or test servers, file-upload and deserialization flaws, hardcoded API tokens and services without multi-factor authentication.
• Into production: credentials, tokens or network paths shared between test and live systems, and misuse of cloud tools such as AWS Systems Manager and Lambda to run commands.
• Around app controls: reverse-engineered apps calling APIs directly, and traffic routed through trusted third-party IP ranges to get past IP allow-lists.
• Cash out: a Rs 1 test transfer to confirm a route, then large transfers to mule accounts, including through merchant settlement APIs, and theft of crypto wallet keys.
• Timing: attacks often during holidays and weekends, when monitoring is thinner.

Who Is Affected

The advisory is aimed at the BFSI sector: NBFCs, digital lending platforms, fintech firms, payment aggregators, payment service providers and crypto exchanges. But the weaknesses it lists are common elsewhere. Any business that runs customer apps, payment integrations, vendor-built APIs or cloud workloads, including e-commerce firms and government payment portals, should read it as a checklist for its own systems.

What to Do Now

1. Separate test from production. Remove shared credentials, keys, databases and network routes between UAT, staging and live systems, take test servers off the internet where possible, and alert on any access from test to production.
2. Validate every transaction on the server. Treat the mobile or web app as untrusted, sign API requests, and replace IP allow-lists for third-party ranges with identity-based controls such as mutual TLS or scoped keys.
3. Clear out long-lived secrets. Scan code repositories and CI/CD pipelines for hardcoded tokens and passwords, rotate them and move to short-lived, narrowly scoped tokens.
4. Patch internet-facing apps first. Prioritise file-upload and deserialization flaws, use WAF virtual patching as a stopgap, and make application folders read-only with file-integrity monitoring for web shells.
5. Watch the cloud control plane. Alert in real time on remote command execution, serverless code changes in production and new users, roles or access keys, and restrict outbound traffic from servers.
6. Add fraud rules for the test-transfer pattern. Flag small transfers to new beneficiaries followed by large ones, add cooling periods and velocity limits, and require maker-checker approval for merchant settlements.
7. Staff up for weekends and verify clean-up. Keep 24x7 monitoring with lower alert thresholds on holidays, and after any incident confirm full removal with forensic checks before declaring it closed.
8. Report suspicious activity. The advisory asks entities to report incidents to CERT-In at incident@cert-in.org.in and to I4C through the CFCFRMS portal. Our CERT-In 6-hour reporting checklist covers the reporting basics.

Your regulator may also have its own expectations. For context on recent banking-sector alerts, see our note on the RBI cyber advisory on credential exposure. For legal or regulatory obligations, check with your compliance team or adviser.

Frequently Asked Questions

What is the CERT-In Crafty Falcon advisory?

It is CERT-In advisory CIAD-2026-0058, issued on 4 November 2026, warning that a threat actor named Crafty Falcon is using AI-assisted tools to attack Indian BFSI entities and misuse their payment and disbursement APIs.

We are not a fintech. Should we care?

Yes, if you run payment integrations, public APIs, customer apps or cloud workloads. The entry points named in the advisory, such as exposed test servers, hardcoded tokens and missing MFA, are common in many industries.

Is a one-time security test enough?

No. The advisory notes repeat attacks after incomplete clean-up. Combine a focused test of your APIs and apps with continuous monitoring and regular re-testing after changes.

How Affix Center Can Help

Affix Center is a Mumbai-based IT services company. Our VAPT services in India cover web, mobile and API testing, including checks for the weaknesses named in this advisory, and our cybersecurity team helps with cloud log monitoring, secrets clean-up and environment separation. If you want a quick review of your exposure, contact our team.