Hackers used China-linked AI tools to steal from Indian financial firms

Representational image

India’s cybersecurity agency has named the hacking ⁠group behind a wave of AI-driven attacks on financial firms and identified the tools it used, at least two of them linked to China, adding India to a growing list of countries where such software has been used against banks.

The group, which the Indian Computer Emergency Response Team (CERT-In) calls “Crafty Falcon,” has breached non-bank lenders, fintech firms and cryptocurrency ‌exchanges, according to an advisory issued on Wednesday (November 4, 2026).

CERT-In did not say who ‌was ⁠behind the breaches, or where the organisation operates.

The advisory came after a ⁠spate of cyberattacks on Indian banks and non-bank lenders in recent weeks, even as authorities issued warnings and the Reserve Bank of India tightened cybersecurity checks.

CERT-In said the attackers use publicly available AI tools to automate ​break-ins “at machine speed”, calling the ‌threat “active and ongoing”.

It named four tools — ARTEX, PentAGI, Cairn, and CyberStrikeAI. Security researchers have linked at least two of them to China.

China-made ARTEX has been used in attacks on South Korean banks since late September, cybersecurity firm CrowdStrike has said. It said ‌a China-linked group also used the tool in an espionage campaign targeting more ​than 200 organisations in at least 14 countries.

CERT-In did not name the affected companies or say how much money was stolen.

The agency did ⁠not say the attacks were state-sponsored and the tools it named have been freely available online. ARTEX, however, was made private by its developer last month after it was linked ‌to the South Korean attacks.

CERT-In, the Indian Cybercrime Coordination Centre and India’s IT ministry did not immediately respond to requests for comment.

CERT-In said Crafty Falcon “surveys its targets with machine intelligence” and moves money using victims’ own payment and disbursement systems.

Attacks were timed around holidays, weekends and other periods where monitoring was likely to have been low to delay detection. Firms that had fixed flaws after earlier alerts were attacked again after incomplete remediations were made, it ‌said.

Reuters previously reported, citing a police complaint, that two Mumbai-based non-bank lenders lost about $2 million ​last month through more than 700 unauthorised instant transfers from accounts of India’s third-largest lender ICICI Bank on October 8 and 9.

The complaint said hackers compromised application programming interfaces (APIs), the software links banks use to connect with non-bank lenders and fintech ⁠firms, to send loan-disbursal instructions.

State Bank of India, the country’s largest lender, disclosed a dark-web leak of 3,897 customer records last month.

Spandana Sphoorty Financial, ‌a non-bank lender, reported unauthorised debits from a bank account on November 1, and AU Small Finance Bank said it was probing a potential customer-data leak.

CERT-In did not ​say which incidents were linked to Crafty Falcon.