India’s cybersecurity agency reports that an AI-boosted hacking campaign is targeting crypto exchanges and financial firms with growing intensity.
An AI-driven threat group has intensified attacks against crypto exchanges and financial firms to steal wallet keys and siphon funds, according to warnings issued by India’s national cybersecurity agency.
The Indian Computer Emergency Response Team (CERT-In) tagged the threat actor as “CRAFTY FALCON” on Wednesday, updating an October alert to explicitly name crypto exchanges as targets while detailing how AI tools are deployed.
“The threat is active and ongoing. CSIRT-Fin continues to receive reports of successful attacks, including from NBFCs and fintech entities that had already received the earlier restricted advisories and had undertaken remediation,” said CERT-In.
Evidence of hackers deploying AI tools against financial institutions has grown following the warning. Cybersecurity firm CrowdStrike reported in October that an unnamed attacker weaponized ARTEX—an AI penetration-testing tool also cited in CERT-In’s alert—alongside Claude Code and other models to compromise South Korean financial firms and exfiltrate data.
CRAFTY FALCON Carries Out Cyberattacks at Machine Speed
CERT-In said the AI-assisted financial threat actor “surveys its targets with machine intelligence, operates at machine speed and strikes by invoking the victim’s own payment and disbursement APIs.”
Nonbank lenders, digital platforms, fintech firms, payment aggregators, service providers, and crypto exchanges are being targeted in the campaign.
Vulnerable applications and exposed testing environments were exploited by attackers using shared credentials and access tokens to pivot into production systems, while cloud infrastructure was also targeted to deploy malicious files, according to CERT-In.
Attackers leveraged AI tools to rapidly produce and refine malicious scripts while reverse-engineering application code to build customized exploits, timing several strikes during weekends and holidays so detection would be delayed.
Small test transactions were executed by attackers in several incidents to validate unauthorized transfers before siphoning larger sums, alongside CERT-In reports of compromised cryptocurrency wallet keys and drained funds.
No affected crypto exchanges were named nor were total financial losses quantified by the agency.
Entities were advised by CERT-In to treat this active campaign as escalating, with the agency urging at-risk companies to maintain round-the-clock security monitoring, boost staffing, and lower alert thresholds throughout weekends, holidays, and low-coverage hours.
“We need to make sure that the best models we can get are in the hands of defenders because attackers will have something capable enough,” he said.
