Severity is Critical. This is an update to CIAD-2026-0046 of Oct 9. The attacker called the victims' own payment and lending APIs, ran small tests of 1 rupee and then moved to large amounts. The public version has no victims, counts or IoCs. Full IoCs are given only to BFSI entities in the TLP version.
Confirmed victims
- NBFC and fintech entities (not named)
Targets
- NBFCs, digital lenders, payment aggregators, crypto exchanges and others
Attribution
- ARTEX basis
- CERT-In CIAD-2026-0058 names ARTEX among public AI attack-and-defense tools and says these tools were used against the affected entities.
- Actor
- CERT-In: CRAFTY FALCON, an AI-assisted financial threat actor.
- Same attacker?
- No link to other cases is stated.
Related events
Sources (1)
- 2026-11-04 Official CERT-In CIAD-2026-0058 Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON