India’s Computer Emergency Response Team has named the active hacking campaign Crafty Falcon and identified four AI-backed software tools used to target non-banking financial institutions and fintechs.
Identification of the Crafty Falcon campaign and the four AI-backed tools
Targeting non-bank lenders, fintechs, and cryptocurrencies
The issue of geographical attribution for open, publicly available software tools
Combining automated vulnerability discovery, stolen credentials, and security controls
Analytical read on the strategic and economic dimensions of the event
Frequently asked questions
Identification of the Crafty Falcon campaign and the four AI-backed tools
India’s national Computer Emergency Response Team (CERT-In) has identified a cyberattack campaign named “Crafty Falcon” and named four publicly available software tools associated with AI-enhanced offensive activities: “Artex,” “PaintIGI,” “Kerne,” and “CyberStrike AI.” According to a Reuters report issued on November 5, 2026, Indian authorities described this activity as active and ongoing, affecting non-banking lending companies, fintech institutions, and cryptocurrency firms.
This announcement represents a substantive update to broader Indian cyber warnings issued on November 4. The new Reuters report adds the name of the campaign, the four specific software tools, and additional details regarding the alleged techniques, without implying that a new, separate attack occurred against each affected institution specifically on November 5.
Targeting non-bank lenders, fintechs, and cryptocurrencies
India’s CERT-In has not identified the entity controlling the Crafty Falcon group or the geographic location of the operators behind it.
Although security researchers have linked at least two of the four mentioned tools to developers in China, the origin or nationality of the authors of publicly available software does not automatically prove the nationality or affiliation of every individual using those tools with a specific country, leaving the official criminal attribution of the campaign unresolved for now.
The issue of geographical attribution for open, publicly available software tools
The main technical concern lies in combining automated security vulnerability discovery, compromised credentials and passwords, and direct access to financial transaction systems. While AI-backed tools may accelerate selected stages of a breach, moving actual funds requires genuine access to applications, APIs, or payment credentials, as an AI model does not independently acquire banking authority simply by generating scripts.
Financial institutions can reduce their exposure to these risks by restricting access permissions, enforcing maximum transaction limits, continuously monitoring, and implementing appropriate response procedures.
Combining automated vulnerability discovery, stolen credentials, and security controls
Some financial institutions have reported cyber incidents over recent weeks, but available reports do not provide a complete list of confirmed victims nor prove that all reported attacks were committed by the same operators. The scale of financial losses directly attributed to the Crafty Falcon campaign also remains unclear.
This development is significant because national authorities are publicly naming specific tools with agentic capabilities and demanding that financial service providers rethink their cyber defenses. Useful evidence in the next phase will include documented incident analyses, actor identification, technical indicators of compromise, and the measured effectiveness of upgraded banking controls. The Indian warning reflects the transition of agent-driven hacking tools from research experiments to actual deployment against emerging financial institutions that may possess less fortified defenses than major traditional banks.
Analytical read on the strategic and economic dimensions of the event
CERT-In’s announcement identifying the active hacking campaign “Crafty Falcon” and naming the four AI-backed tools “Artex,” “PaintIGI,” “Kerne,” and “CyberStrike AI” highlights the accelerating evolution of cybercrime arsenals directed against the financial sector. The campaign’s focus on non-banking lending companies, fintech institutions, and cryptocurrency firms reflects attackers targeting fast-growing digital financial rings that may lack the same levels of cyber fortification available at major traditional banks.
At the same time, technical and legal analysis of this warning underscores two fundamental realities: first, linking certain publicly available tools to developers in China is not enough by itself to prove official criminal attribution for the actual operators of the campaign; and second, AI tools accelerate vulnerability discovery but cannot move funds without actually seizing credentials and payment system permissions. Therefore, protecting digital identities, restricting access privileges, and enforcing strict transaction limits remain the primary line of defense for financial institutions.
Frequently asked questions
Question: What is the name of the hacking campaign revealed by Indian authorities and what tools are used in it?
Answer: CERT-In named the campaign Crafty Falcon and identified four publicly available, AI-backed tools: Artex, PaintIGI, Kerne, and CyberStrike AI.
Question: What sectors are targeted by the Crafty Falcon campaign in India?
Answer: The campaign targets non-banking lending companies, fintech institutions, and cryptocurrency firms.
Question: Have Indian authorities officially identified the country or entity behind the campaign?
Answer: No, the agency has not identified the operators or their location. Although researchers have linked at least two tools to developers in China, using publicly available tools does not prove the identity of their users.
Question: How can financial institutions protect their systems from these intelligent tools?
Answer: By tightening access privilege controls, protecting credentials, enforcing financial transaction limits, and stepping up monitoring and rapid response procedures.
