India’s cybersecurity agency, CERT-In, has flagged a Chinese-linked hacking campaign using AI tools like ARTEX to target over 200 organizations globally, including Indian financial firms, since October 17, 2026. The threat actor, tracked as Crafty Falcon, has exploited AI-driven offensive tools to automate attacks at machine speed, according to CERT-In’s November 5, 2026 advisory.
India flags Chinese-linked AI tools in hacking campaign against financial firms
ARTEX is an open-source, multi-agent AI penetration-testing framework initially developed for offensive security research. After its misuse in real-world attacks—including against South Korean financial institutions—its developers made it proprietary.
Key numbers
| Stat | Figure | Date | Source |
|---|---|---|---|
| Organizations targeted globally | 200+ | October 17, 2026 | CrowdStrike |
| AI tokens consumed in one intrusion | 1.4 billion | 2026 | CrowdStrike |
| Unauthorized fund transfers in Mumbai NBFCs | $2 million | October 8–9, 2026 | ETBFSI |
| Customer records exposed in SBI breach | 3,897 | October 21, 2026 | ETBFSI |
Who is affected?
Indian financial firms, including banks, non-banking financial companies (NBFCs), fintechs, cryptocurrency exchanges, and digital asset service providers, are the primary targets of the Crafty Falcon campaign. CERT-In’s November 5, 2026 advisory highlights that attackers have compromised payment aggregators, partner-bank API credentials, and fund-transfer systems, leading to unauthorized transactions. Globally, the campaign has also hit telecommunications providers, government ministries, pharmaceutical firms, and semiconductor companies.What happened?
The hacking campaign began on October 17, 2026, when Chinese-linked threat actors—tracked as Crafty Falcon—deployed AI-driven offensive tools like ARTEX, PentAGI, Cairn, and CyberStrikeAI to automate attacks against Indian financial firms. These tools execute complete attack chains autonomously, generating tailored scripts and adapting payloads based on target responses. Attackers exploited vulnerabilities in APIs, exposed credentials, and privileged endpoints to bypass controls like KYC verification, loan sanction limits, and beneficiary verification. Funds were siphoned into mule accounts across multiple banks, often after small test transactions validated unauthorized routes. See the table above for verified figures.What to do next?
Financial institutions should immediately implement CERT-In’s November 4, 2026 advisory, which recommends daily and per-transaction payment limits, beneficiary-name verification, and round-the-clock monitoring of suspicious transactions. Banks must audit APIs, close dormant interfaces, enforce multi-factor authentication, and isolate testing environments from production systems. RBI has directed lenders to treat technology environments as potentially compromised until forensically cleared after credential exposure.What we know and don’t know
We know the threat actor is linked to China and uses AI tools like ARTEX, which has been backdoored in multiple GitHub repositories since October 20, 2026. However, we don’t yet know the full extent of financial losses in India beyond the $2 million NBFC fraud or the exact number of Indian financial firms compromised. The timeline of attacks remains ongoing, with no confirmed end date.Timeline
- October 17, 2026: Chinese-linked hackers (Crafty Falcon) begin using ARTEX AI in attacks against 200+ organizations globally, including Indian financial firms.
- October 20, 2026: Backdoored ARTEX Docker image appears on GitHub, granting root access to 62 consoles by November 4, 2026.
- October 21, 2026: State Bank of India discloses exposure of 3,897 customer records on the dark web.
- October 8–9, 2026: Two Mumbai NBFCs lose $2 million via unauthorized fund transfers through compromised APIs.
- November 4, 2026: CERT-In issues a warning about AI-driven attacks targeting BFSI sectors, citing multi-crore unauthorized transactions.
- November 5, 2026: CERT-In publishes AI Security Auditing Guidelines and flags ongoing Crafty Falcon campaign.
Why it matters
The escalation of AI-assisted cyberattacks poses a direct threat to India’s financial stability, as attackers bypass traditional security controls to steal funds and compromise customer data. The use of AI tools like ARTEX automates attacks at machine speed, making detection and mitigation more challenging. For financial institutions, this underscores the need for robust AI governance, real-time monitoring, and stricter access controls to prevent credential theft and unauthorized transactions.Frequently asked questions
What is ARTEX AI, and why is it being used in attacks?
ARTEX is an open-source, multi-agent AI penetration-testing framework initially developed for offensive security research. After its misuse in real-world attacks—including against South Korean financial institutions—its developers made it proprietary. However, backdoored copies of ARTEX have resurfaced on GitHub and Docker Hub, granting attackers root access to compromised systems. The tool automates reconnaissance, exploits vulnerabilities, and deploys web shells, making it a potent weapon for hackers like Crafty Falcon.
How do AI-driven attacks differ from traditional cyberattacks?
AI-driven attacks automate multiple stages of intrusion—from reconnaissance to credential theft—at machine speed, unlike traditional attacks that rely on manual exploitation. Tools like ARTEX generate and refine attack scripts rapidly, adapt payloads based on target responses, and even skip protected systems (e.g., CrowdStrike’s Falcon). This speeds up breaches and makes them harder to detect, as seen in the Crafty Falcon campaign targeting Indian financial firms.
What are the most common initial access vectors used in these attacks?
The primary entry points include stolen long-lived API tokens, supply chain compromises via forged source code commits, exposed plaintext credentials in configuration files, and applications lacking multi-factor authentication. Attackers also exploit internet-facing applications, exposed APIs, and privileged endpoints to gain footholds in financial systems.
How can banks and fintechs protect themselves from AI-driven attacks?
Banks and fintechs should enforce multi-factor authentication, audit APIs for exposed credentials, isolate testing environments from production, and implement daily transaction limits. CERT-In recommends real-time monitoring of cloud infrastructure, forensic verification after incidents, and using short-lived access tokens.
Has India’s government responded to these cyber threats?
Yes. The Reserve Bank of India (RBI) has intensified scrutiny of banks’ cybersecurity preparedness, directing lenders to treat compromised environments as potentially breached. CERT-In issued advisories on November 4 and 5, 2026, warning of AI-driven attacks and outlining mitigation steps. Financial institutions are now required to report incidents to CERT-In within six hours and to RBI via the DAKSH portal.
What are the financial implications of these attacks?
The immediate financial impact includes unauthorized fund transfers like the $2 million loss by Mumbai NBFCs and the exposure of 3,897 SBI customer records. Longer-term risks include reputational damage, regulatory penalties, and systemic instability if attacks escalate. The broader financial sector faces higher operational costs for cybersecurity upgrades and potential losses from undetected breaches.
About: India
See what America is searching today →
Sources
- Chinese hackers use ARTEX AI in automated attacks against 200 orgs — bleepingcomputer.com, 2026-11-02
- CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access — thehackernews.com
- Explained: Why cyberattacks are rising on Indian banks and fintechs, and what's being done to stop them? — bfsi.economictimes.indiatimes.com, 2026-11-05