{"id":3956,"date":"2026-11-05T07:09:51","date_gmt":"2026-11-05T15:09:51","guid":{"rendered":"https:\/\/cyber.mag212.com\/crafty-falcon-cert-in-ai-assisted-attacks-payment-firms\/"},"modified":"2026-11-05T07:09:51","modified_gmt":"2026-11-05T15:09:51","slug":"crafty-falcon-cert-in-ai-assisted-attacks-payment-firms","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/crafty-falcon-cert-in-ai-assisted-attacks-payment-firms\/","title":{"rendered":"Crafty Falcon\u00a0: Le CERT-In met en garde contre des attaques assist\u00e9es par l\u2019IA visant les pr\u00eateurs, les fintechs et les soci\u00e9t\u00e9s de paiement indiennes."},"content":{"rendered":"

India’s national CERT has escalated its warning about attacks on lenders, fintechs and payment companies. Advisory CIAD-2026-0058<\/strong>, issued November 4 and rated Critical, ties the activity to a threat actor called “CRAFTY FALCON”<\/strong> and says the threat is “active and ongoing”. It also describes something new: AI-generated attack tooling that produces fresh script variants and rotates infrastructure faster than blocklists can keep up.<\/p>\n\n

Faits cl\u00e9s<\/h2>\n\n
Article<\/th>D\u00e9tail<\/th><\/tr><\/thead>
Advisory<\/td>CERT-In CIAD-2026-0058, November 4, 2026, severity Critical<\/td><\/tr>
Earlier warning<\/td>CIAD-2026-0046, October 9, 2026 (no actor named)<\/td><\/tr>
Actor name<\/td>“CRAFTY FALCON”, designated by CSIRT-Fin, the financial-sector CSIRT under CERT-In<\/td><\/tr>
Targets<\/td>NBFCs, digital lenders, fintechs, payment aggregators and PSPs, crypto exchanges and VDASPs<\/td><\/tr>
Tooling named<\/td>ARTEX LLM tools, PentAGI, Cairn, CyberStrikeAI<\/td><\/tr>
Victims<\/td>No count published; no CVE named<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

What CERT-In describes<\/h2>\n\n

The October 9 advisory warned that attackers were abusing payment and disbursement APIs to move money without authorization. The November 4 escalation goes further. It names the actor, and it describes many functionally identical script variants (consistent with AI-generated code), payloads that adapt to how the target responds, and IP addresses that rotate within hours to days.<\/p>\n\n

A restricted version with full indicators of compromise went only to financial-sector entities. The public advisory gives no victim or loss figures. Press reports mentioning large AI-fraud losses cite a separate agency’s findings, not this advisory.<\/p>\n\n

\"Diagram
Crafty Falcon tradecraft as a composite path with selected CERT-In controls. It does not depict a single observed incident. MAG212 CYBER original diagram.<\/figcaption><\/figure>\n\n

How the attacks work<\/h2>\n\n