CERT‑In pins AI‑driven hacking group ‘Crafty Falcon’ on Indian financial firms

India’s cyber‑security agency has named a group called Crafty Falcon as the force behind a surge of AI‑powered hacks on banks, non‑bank lenders and crypto exchanges. CERT‑In’s advisory lists four AI hacking tools used in the campaign, with at least two traced to China. The attackers exploit publicly available AI platforms to scan targets, then hijack the victims’ own payment and disbursement APIs to move money. Attacks are timed around holidays, weekends and other low‑monitoring windows, and some firms were hit twice after only partial fixes. Recent breaches include two Mumbai‑based non‑bank lenders losing about $2 million in over 700 unauthorized instant transfers from ICICI Bank accounts on Oct 8‑9, a dark‑web leak of 3,897 State Bank of India customer records, unauthorised debits reported by Spandana Sphoorty Financial on Nov 1, and a probe by AU Small Finance Bank into a possible data leak. The Reserve Bank of India has tightened cyber‑security checks as the threat is described as “active and ongoing.” CERT‑In also disclosed access to Anthropic’s Claude Mythos model for controlled vulnerability testing, underscoring a shift toward AI‑assisted defence. ## Context AI tools can test thousands of code paths in seconds, making them attractive for criminals targeting vulnerable banking APIs. Similar China‑linked tools have already been linked to attacks on South Korean banks, showing a broader regional pattern of AI‑enabled financial cyber‑crime.