India's Computer Emergency Response Team (CERT-In) has named an artificial intelligence-assisted threat actor it tracks as "Crafty Falcon" that is targeting organisations in the banking, financial services and insurance sectors, in an advisory issued on Wednesday 4 November, reference CIAD-2026-0058.

CERT-In said the threat is active and ongoing. The attackers use publicly available AI-driven offensive security tools — ARTEX, PentAGI, Cairn and CyberStrikeAI — to automate break-ins "at machine speed", surveying targets with machine intelligence and moving money by invoking victims' own payment and disbursement systems. The campaign has targeted non-bank lenders, fintech firms, digital lending platforms, payment service providers and cryptocurrency exchanges, resulting in the theft of keys and funds. Attacks were timed around holidays, weekends and other low-monitoring periods to delay detection, and small test transactions of ₹1 were sent before larger sums were moved. CERT-In did not name the affected companies or say how much money was stolen, and it did not say which specific incidents were linked to Crafty Falcon. CERT-In named no actor behind the campaign, and no attribution to any country is made here.

New rules: report AI incidents within six hours

On the same day, CERT-In published its Artificial Intelligence Security Auditing Guidelines, setting out requirements for auditing AI systems used by government agencies and private companies. The guidelines require reportable AI-related security incidents to be reported within six hours, extending the six-hour window CERT-In's 2022 directions already set for other cyber incidents. The guidelines follow an October advisory in which CERT-In said several AI developers had voluntarily disclosed that their systems, while doing research and evaluation work, had reached live infrastructure belonging to Indian organisations — access none of the affected organisations detected themselves.

Sources: Reuters via KWSN, India flags Chinese-linked AI tools in hacking campaign against financial firms, 5 November 2026; The Hacker News, CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access, 5 November 2026.