{
  "id": 18425780,
  "title": "Threat actor targets Indian fintechs on weekends when defenders aren’t watching",
  "url": "https://urgent.news/2026/11/06/threat-actor-targets-indian-fintechs-on-weekends-when-defenders-arent-18425780",
  "topic": "culture",
  "section": "Culture",
  "published": "2026-11-06T01:17:40.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/11/06/threat-actor-targets-indian-fintechs-on-weekends-when-defenders-arent-watching/5308000"
  },
  "original_language": "en",
  "account": "India's Computer Emergency Response Team has issued a warning about a surge in attacks from an AI-enhanced threat actor known as \"CRAFTY FALCON\" targeting Indian financial services, with a particular focus on weekends and holidays. CERT-IN first identified the attacks in October, advising digital lending firms, fintech companies, payment service providers, and wallet operators to safeguard internet-facing applications, exposed APIs, and privileged endpoints. The attackers utilize payment APIs to siphon funds and have been found to re-target victims who had previously remediated their systems. CRAFTY FALCON employs tools like ARTEX, Cairn, and CyberStrikeAI, all of which are linked to Chinese speakers. The group infiltrates internet-exposed environments used for testing or development, exploits newly discovered vulnerabilities, and tests its attacks with small transactions before escalating to larger ones, particularly targeting cryptocurrency exchanges. CERT-IN recommends enhancing event logging, real-time monitoring, alerting, and restricting access to cloud resources. The warning is especially pertinent given India's vast banking and financial ecosystem, many of which may lack robust cybersecurity measures.",
  "summary": "CERT-IN warns of ‘significant escalation’ in AI-powered attacks, some after victims tried to improve defences",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}