India's cyber agency says AI-assisted hackers are stealing money from financial firms, often on weekends and holidays, and some were hit again after fixing problems.
India's national cyber agency, Cert-In, has warned banks and financial firms that hackers are using free, publicly available AI tools to break in and move money out. It calls the campaign Crafty Falcon. The agency issued the new advisory on Wednesday and says the threat is active and ongoing.
This is an update to a warning Cert-In sent on October 9 about criminals abusing the payment systems that banks and apps use to send money. Since then, the agency says the campaign has grown significantly. Reports of successful attacks keep coming in, including from lenders and fintech firms that had already received the earlier warning and made fixes.
Cert-In says the AI tools can run a whole attack with little human help and at machine speed. They can write and rewrite many custom attack programs in quick succession, and they adjust based on how a target system responds.
The agency describes several tricks. Attackers get in through test systems that are open to the internet, then reach live systems because the two share passwords or access keys. They also abuse cloud services, and they alter copies of mobile apps to send unauthorized payment requests.
Some attackers first send a tiny transfer, sometimes just ₹1, to check that their stolen access works. Larger sums follow. Crypto exchanges have also been hit, with attackers stealing wallet keys and draining funds.
The attacks are timed for holidays, weekends and other periods when fewer people are watching. That delays detection and response. Cert-In also says some organizations were deliberately targeted again, including ones that had not fully fixed the weaknesses found earlier.
The warning is aimed at banks, non-bank lenders, fintech apps, payment companies and crypto exchanges in India. Their customers are affected too, since it is their money at stake. The material does not say how many firms were hit or how much money was lost.
The alert box above lists the steps. The short version: watch closely when offices are quiet, treat a tiny payment to a new recipient as a warning sign, and keep test and live systems apart. Anyone who suspects a breach should report it to Cert-In or its finance team, CSIRT-Fin.
If you run payments or online banking, treat a tiny transfer to a new recipient as a warning sign, and watch hardest on weekends and holidays.
Fake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourselfSecurity firm Flashpoint says criminals are trading in refund tricks, gift card fraud and hacked online stores ahead of the holidays. Shop owners should check their refund steps.
Read more: Scammers are targeting store refunds and gift cards before the holidaysThe Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone calls
