AI hackers use ₹1 test transactions to move bigger sums from financial firms: CERT-In warns

A fraudulent transaction does not always begin with a large amount of money. Sometimes, even a ₹1 transfer can be part of a much bigger cyberattack. India's cybersecurity agency has now flagged a campaign in which hackers are using artificial intelligence to identify weaknesses in financial systems, test unauthorised payment routes and attempt larger fund transfers.

The operation, identified as 'CRAFTY FALCON', the Indian Computer Emergency Response Team (CERT-In) has classified as an active, ongoing threat. Its latest advisory on November 4 warns that the attackers are targeting several parts of India's banking, financial services and insurance (BFSI) ecosystem.

MUST READ | PHP security flaws raise hacking concerns: 5 ways to protect your accounts and stay safe online

How the CRAFTY FALCON campaign operates

According to CERT-In, attackers use publicly available AI-driven tools, including ARTEX, PentAGI, Cairn and CyberStrikeAI, to automate entire attack chains. These tools can generate customised scripts, modify their payloads based on how targeted systems respond and execute multiple attacks at machine speed. Their supporting infrastructure also changes IP addresses within hours or days.

The agency has identified several methods used in these attacks. Hackers have exploited cloud management services such as AWS Systems Manager and Lambda to execute commands and deploy malicious files. They have also entered production systems through exposed testing and staging environments, using shared credentials, tokens and network connections.

DON'T MISS | SBI’s cyber wake-up call after data breach: Fight AI with AI

In another technique, attackers reverse-engineer application code and modify application packages to make unauthorised API calls. They also bypass IP allow-listing by routing traffic through whitelisted third-party fetcher services.

The campaign has involved testing payment routes through micro-value transactions, as small as ₹1 transfers, before attempting larger unauthorised payments. Attackers have also targeted merchant settlement APIs and cryptocurrency wallets, stealing wallet keys and siphoning funds. Newly disclosed file-upload and deserialization vulnerabilities in PHP and Node.js applications have also been exploited to deploy web shells.

What financial firms need to do

CERT-In says successful attacks have continued, including against NBFCs and fintech companies that had already attempted remediation. Some were targeted again after incomplete security fixes, with attackers timing operations around weekends and holidays.

The agency has advised financial institutions to strengthen round-the-clock monitoring, secure cloud infrastructure, separate testing environments from production systems and patch vulnerabilities quickly. It has also recommended flagging ₹1 test transactions to new beneficiaries followed by larger transfers, introducing cooling periods for new beneficiaries and monitoring unauthorised AI tools and large language model API usage.