CERT-In flags Crafty Falcon, AI-assisted attacks on lenders' payment APIs

TL;DR

• CERT-In's 4 November advisory names an AI-assisted campaign, Crafty Falcon, that uses victims' own payment and disbursement APIs for unauthorised transfers, Inc42 and Moneycontrol report.
• Business Standard says the advisory names four public AI attack tools and lists fixes, from separating staging from production to signing API requests.
• NBFCs and fintechs that had acted on earlier advisories still reported successful attacks, the advisory says.