Crafty Falcon: How an AI-Assisted Actor Steals From Indian BFSI Through Its Own APIs

    Monday, November 9, 2026 In: Threat Research Print

    Date: 11/09/2026

    Severity: Critical

    Summary

    Crafty Falcon is an AI-assisted financial threat actor identified by CERT-In's CSIRT-Fin in advisory CIAD-2026-0058, targeting India's NBFCs, digital lenders, fintech companies, payment aggregators, and cryptocurrency exchanges. The actor reportedly uses four AI-powered offensive tools (ARTEX, PentAGI, Cairn, and CyberStrikeAI) to identify vulnerabilities and exploit weaknesses in financial systems. Instead of relying only on traditional data theft, attackers abuse victims' own payment and disbursement APIs to initiate unauthorized financial transactions. The campaign is rated Critical and remains active, with some organizations reportedly targeted again even after remediation. This highlights the growing risk of AI-assisted attacks against India's financial ecosystem. 

    Indicators of Compromise (IOC) List

    Domains/URLs

    xcai.pro

    direct.xcai.pro

    fofoapi.com

    u6ud2s.dnslog.cn

    IP Address

    38.244.50.120

    23.248.226.250

    154.201.79.246

    101.53.80.20

    205.214.59.31

    124.155.252.63

    23.248.249.90

    23.158.220.98

    103.248.148.84

    203.160.133.172

    209.209.85.38

    156.251.11.39

    130.94.31.86

    202.95.14.60

    212.129.221.26

    149.88.85.20

    118.107.47.11

    212.11.64.250

    Hash

    C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "direct.xcai.pro" or url like "direct.xcai.pro" or siteurl like "direct.xcai.pro" or domainname like "xcai.pro" or url like "xcai.pro" or siteurl like "xcai.pro" or domainname like "u6ud2s.dnslog.cn" or url like "u6ud2s.dnslog.cn" or siteurl like "u6ud2s.dnslog.cn" or domainname like "fofoapi.com" or url like "fofoapi.com" or siteurl like "fofoapi.com"

    Detection Query 2 :

    dstipaddress IN ("23.158.220.98","101.53.80.20","203.160.133.172","118.107.47.11","212.129.221.26","205.214.59.31","103.248.148.84","154.201.79.246","209.209.85.38","156.251.11.39","38.244.50.120","130.94.31.86","23.248.226.250","212.11.64.250","149.88.85.20","124.155.252.63","202.95.14.60","23.248.249.90") or srcipaddress IN ("23.158.220.98","101.53.80.20","203.160.133.172","118.107.47.11","212.129.221.26","205.214.59.31","103.248.148.84","154.201.79.246","209.209.85.38","156.251.11.39","38.244.50.120","130.94.31.86","23.248.226.250","212.11.64.250","149.88.85.20","124.155.252.63","202.95.14.60","23.248.249.90")

    Detection Query 3 :

    sha256hash IN ("C7A884AFCD7F91408921890D9617BEF6BFAC3DAE992BC25BB9C48C0395A60842")

    Reference:    

    Crafty Falcon Uses AI to Target Indian BFSI APIs 

    CERT-In Security Advisory – CIAD-2026-0058


    Tags

    Threat ActorIndiaFinancial ServicescryptocurrencyAI

    « Previous Article

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.