What CERT-In reports
In advisory CIAD-2026-0058, dated November 4, 2026, CERT-In describes escalation of a campaign targeting Indian banking, finance, fintech and related payment service organizations. The agency attributes reported activity to an actor it calls CRAFTY FALCON and describes AI-assisted offensive tooling and attempts to abuse payment and disbursement APIs.
Reported attack patterns
The advisory discusses exposed testing environments, cloud management-service misuse, modified client applications, shared third-party IP allowlists and small test transactions as part of observed attack paths. Those details are CERT-In's reported findings, not independently confirmed claims by CyberGeek News about specific victims.
What defenders should do
CERT-In recommends around-the-clock monitoring, segregating staging and production credentials, validating every payment API request on the server, investigating low-value test transactions before high-value transfers, and addressing internet-facing software vulnerabilities.
Editorial caution
This story contains operational threat-actor attribution and incident claims. It requires a human editor to check the complete original advisory, its scope and attribution before publication. Restricted indicators should not be reproduced.
Primary source: CERT-In advisory CIAD-2026-0058, November 4, 2026.