Financial institutions, retailers and their customers face unauthorised transfers, stolen payment data, compromised cryptocurrency wallets and disrupted services as artificial intelligence helps attackers move faster through vulnerable systems.
India’s computer emergency response team, CERT-In, says the active CRAFTY FALCON campaign is targeting several parts of the country’s banking, financial services and insurance ecosystem with publicly available AI-driven tools.
The campaign is best read as a change in the economics of intrusion. The tools can create tailored scripts, alter malicious payloads in response to a system’s behaviour and run several attacks at machine speed. That gives attackers a way to test a target cheaply before seeking a larger return.
In this case, CERT-In said attackers have sent micro-value transactions, including transfers as small as ₹1, to test payment routes before trying larger unauthorised payments. They have also gone after merchant settlement application programming interfaces and cryptocurrency wallets, taking wallet keys and siphoning funds.
Some successful attacks have continued against non-banking financial companies and fintech businesses after those organisations had tried to fix their systems. The attackers have timed their operations around weekends and holidays, CERT-In said.
The agency has advised firms to flag ₹1 payments to new beneficiaries when larger transfers follow, impose cooling periods for new beneficiaries, and watch for unauthorised AI tools and use of large language model application programming interfaces.
The wider risk is acceleration rather than an entirely new kind of attack. AI is highly likely to increase the speed, scale and efficiency of hostile operations across reconnaissance, social engineering, vulnerability discovery and exploit development. Its largest effect is expected to be the faster, broader use of existing tactics, techniques and procedures.
AI models can now find weaknesses in large codebases and system misconfigurations that had historically gone undetected. That leaves defenders and system maintainers in a race to shorten the time between identifying a vulnerability and deploying a patch, before attackers can build a working exploit.
The divide will be shaped by resources and readiness. Organisations with mature cyber security programmes, robust AI governance and sufficient resources are likely to improve threat detection, vulnerability prioritisation and defensive automation. Those operating legacy technology with weaker security and limited resources may struggle to match the speed of AI-assisted attacks.
Frontier AI models have already enabled threat actors to carry out intrusions in under 10 hours, a task that previously required multi-operator teams working two weeks. The advantage is particularly consequential where a single opening can expose a payment system or halt a sales channel.
Retailers offer a parallel example. Unit 42 researchers recorded a sharp rise in financially motivated attacks against retail organisations during the 2026 peak holiday shopping season, with threat actors claiming 565 retail victims through September 2026.
The attacks included ransomware that disrupted order fulfilment, data theft and extortion, distributed denial-of-service floods, credential stuffing and gift card fraud. They also included digital skimming through the CosmicSting vulnerability, CVE-2024-34102.
CosmicSting allows a remote attacker without authentication to achieve remote code execution through crafted XML input. That can support persistent backdoors and the insertion of payment-skimming scripts into checkout flows. Use of the vulnerability to inject JavaScript payment skimmers exposed cardholder data at scale across approximately 5% of all affected e-commerce platforms globally.
The contest is therefore increasingly about operational tempo. Attackers need to find a gap in a payment route, a checkout system or a poorly configured service. Defenders need to find and fix every weakness fast enough to prevent that gap becoming a route to funds or customer data.
Comments (0)