The advisory, CIAD-2026-0058, was issued on November 4. It updates an October 9 advisory (CIAD-2026-0046) on attackers exploiting payment and disbursement APIs to make unauthorised fund transfers. CERT-In said continued analysis of reported incidents showed a significant escalation since then.
India’s cyber agency CERT-In has issued a critical-severity advisory on a growing campaign of AI-assisted attacks on banks, lenders and payment firms. It warns that the threat is active and still escalating.
Some firms were deliberately attacked again after incomplete clean-ups, and attacks were timed for holidays, weekends and other low-monitoring windows to delay detection.
These include entities that had received earlier restricted advisories and had already carried out remediation.
CERT-In said the attackers are using several publicly available AI offensive-security tools, including the ARTEX family of LLM-based tools, the PentAGI autonomous multi-agent penetration testing system, the Cairn attack search engine and the CyberStrikeAI framework. The agency said these tools run complete attack chains on their own, generate and refine large numbers of tailored scripts in quick succession, and adapt payloads based on how the target responds. The attackers’ infrastructure changes IP addresses within hours or days. * Cloud abuse: Attackers misuse cloud management and serverless services, such as AWS Systems Manager and Lambda, to run commands and deploy malicious files, blending in with legitimate activity. * Tampered apps: Attackers reverse-engineer application code and send unauthorised API calls using modified app packages, defeating controls that assume only the genuine app will call the APIs. * Server-side validation of every transaction, API request signing and app attestation, rather than trusting client apps. * Banning unauthorised AI offensive tools on corporate systems and watching for LLM API traffic from servers.