Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhighExploited in the wild

CERT-In warns CRAFTY FALCON is hitting Indian payment APIs

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CERT-In says an active campaign is abusing Indian payment APIs, with firms hit again after an October warning.

CERT-In says the active CRAFTY FALCON campaign is stealing money from Indian NBFCs, lenders, payment firms, wallets and crypto exchanges through their own payment APIs. Attackers use exposed staging systems, hardcoded tokens and public upload or deserialization flaws, then shared credentials to reach production. A small test transfer precedes larger payments to mule accounts, and logs are tampered with. The Register reports $0.01 tests and says CERT-In named the actor; Cyble reports a Rs 1 test and says neither the actor nor a victim count was named. Firms patched after an October 9 warning were attacked again on holidays. Advisory CIAD-2026-0058 lists ARTEX, PentAGI, Cairn and CyberStrikeAI.

Key facts
  • Advisory CIAD-2026-0058 updates an October 9 CSIRT-Fin warning.
  • Intrusions use staging systems, hardcoded tokens, and upload or deserialization flaws.
  • Allow-listed fetcher traffic bypasses KYC, balance and limit checks.
  • Named tools are ARTEX, PentAGI, Cairn and CyberStrikeAI.
  • Outlets disagree on the test amount and whether the actor was named.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 9, 2026CERT-In warning later updated as CIAD-2026-0058 · Cyble

What each outlet adds

beyond the shared facts
  • The RegisterReports $0.01 tests, weekend timing, and offline test environments.
  • CybleDetails re-attacks, entry paths, Rs 1 tests, and unnamed actor.
Vendors
CERT-IN
Threat actors
CRAFTY FALCON
Malware
ARTEXPentAGICairnCyberStrikeAI
Victims
Indian fintechsdigital lending platformspayment service providerswallet operators
Organizations
CERT-InCSIRT-Fin
Countries
India

Coverage

oldest first · one row per article · UTC
  1. · 6d ago The Register · SecurityFirst report

    CRAFTY FALCON targets Indian fintechs on weekends

    CERT-IN names actor CRAFTY FALCON and warns of active AI-powered attacks timed to low-monitoring periods.

  2. · 1d ago Cyble

    CERT-In says CRAFTY FALCON is hitting Indian fintech payment APIs

    Remediated firms were attacked again on holidays, and CERT-In has not named the actor or victim count.