CERT-In Names CRAFTY FALCON, a Group Using AI Attack Tools and Rs 1 Transfers Against Indian Payment APIs

CERT-In, India's national computer emergency response team, has given a name to the actor behind attacks on payment APIs at Indian financial firms: CRAFTY FALCON, a label from its finance-sector arm CSIRT-Fin, according to MediaNama's reading of a November 4, 2026 update to the team's October 9 advisory.

The update lists AI-assisted tools and a set of techniques that start in cloud accounts and end in settlement APIs. It does not say how many firms were hit or how much money moved.

I could not extract text from the three-page PDF that MediaNama links, so the November 4 details below are attributed to MediaNama's summary and not to the document itself.

The advisories, by date

Date	Reference	What it covers
Oct. 9, 2026	CIAD-2026-0046	Critical advisory on stolen payment and partner-bank API credentials at NBFCs, lenders, fintechs and wallet operators
Oct. 15, 2026	CIAD-2026-0049	Critical advisory on AI agents that exceeded their authorisation and on criminal use of agentic frameworks
Nov. 4, 2026	Update to the Oct. 9 advisory	Names CRAFTY FALCON and adds tools and techniques

The October 9 text, as MediaNama reported it, describes attackers calling disbursal and fund-transfer APIs from inside an institution's whitelisted infrastructure. That path skips KYC, sanction checks, beneficiary verification, balance checks and per-transaction limits. Transfers carry dummy reference identifiers, land in mule accounts across several banks and move over IMPS and NEFT before immediate withdrawal.

Four tools and a Rs 1 test

MediaNama lists the tools in the November 4 update as the ARTEX family of LLM-based tools, PentAGI (an autonomous multi-agent penetration testing system), the Cairn attack search engine and the CyberStrikeAI framework.

The techniques it lists are specific:

• Running commands and deploying files through AWS Systems Manager and Lambda.
• Reaching production from internet-exposed testing and staging environments through shared credentials, tokens and network paths.
• Routing traffic through shared third-party fetcher IP pools, from content-acceleration and app-store review services, to get past IP allow-lists.
• Sending micro-value transactions of Rs 1 to test unauthorised fund flows before larger transfers.

The advisory also reports the group targeted newly disclosed PHP and Node.js application flaws, stole cryptocurrency wallet keys and kept attacking organisations that had already remediated, including on weekends and holidays. That last point matters for staffing: CERT-In's response, per MediaNama, is 24x7 monitoring with more people on weekends.

What Akamai adds, and its interest

Stas Neyman, Director of Product Marketing at Akamai, wrote on October 28 that "agentic tooling compressed the interval between initial access and final impact from days to just a few hours." Akamai sells API security, and its post cites more than 200 automated API security tests, a vendor claim. Neyman's account of the October advisories matches MediaNama's on dates, IDs and root causes: credentials in source code, dormant APIs reachable from the internet, plaintext payment API keys and overly permissive cloud roles.

Both accounts repeat CERT-In's observation that firms with incomplete fixes were attacked again within days, sometimes at larger scale. CERT-In's October 15 advisory, per MediaNama, found the weaknesses conventional. What changed was speed. For the same compression of time on another bug, see the 19 hours PHP2Shell took against a bitcoin bounty, and for agents acting beyond their remit, OpenAI's GPT-6 Astra safety findings.

What is still unknown

MediaNama said the October 9 advisory disclosed no affected entities, no incident count and no amount stolen. Experts in its coverage argue the recommendations are well known and can be satisfied on paper. The November 4 update, as summarised, does not change that.

The recommendations are concrete where the data is not: isolate staging from production, remove shared credentials, validate transactions server-side, apply cooling periods for new beneficiaries and require multi-signature approval for crypto withdrawals. Affected firms are asked to report to CERT-In or CSIRT-Fin.