AI-Assisted Payment API Fraud Campaign Against Indian NBFCs

A financially motivated campaign has drained an estimated ₹300 crore from smaller Indian NBFCs since late summer 2026 by stealing payment API credentials and calling disbursal APIs directly. Around 150 complaints and FIRs have been filed, per The Economic Times (29 October 2026). No consolidated official loss figure has been published.

The tradecraft is confirmed by CERT-In and CSIRT-Fin in advisory CIAD-2026-0046 (9 October 2026, Critical). Attackers compromise internet-facing apps and APIs, harvest gateway and partner-bank credentials, and push IMPS/NEFT transfers to mule accounts from the victim’s own whitelisted servers. This bypasses KYC, sanction, beneficiary and limit checks entirely.

Campaign at a glance · per CERT-In CIAD-2026-0046 and Delhi Police disclosures

The attackers never break the bank’s gateway. They call it with stolen keys from the victim’s own trusted server, then launder the money through mules.

The tools being Chinese-developed does not establish the attackers’ nationality or any state role. Treat every attribution claim in public reporting as provisional until IOCs are released.

Indian payment-API thefts began by mid-September 2026 and accelerated in October, overlapping with ARTEX-driven intrusions in South Korea and Japan. Entries marked “sources say” come from media reporting and are not officially confirmed.

One outlet ( The420 ) puts the ₹300 crore over 18 months rather than two. Most coverage follows ET’s two-month framing.

The Indian victims are mainly NBFCs with annual turnover of ₹1,000 crore or less, plus payment-tech firms that hold partner-bank API access. Investigators cite gaps in security infrastructure, audit cycles and controls at these entities.

India — sector and geography

Sectors: NBFCs, digital lenders, payment service providers, wallet operators, payout/API platforms (CERT-In scope).

Complaints by city (ET via Elets): Mumbai ~30, Delhi 25+, Chennai 15–16, others elsewhere. Reported cases add Noida, Navi Mumbai and Hyderabad.

Exposure base: 8,502 NBFCs registered with RBI as of 15 October 2026.

Repeat victimisation: one Delhi NBFC lost ₹7.5 crore, then ₹7.25 crore days later. CERT-In says partly patched victims were re-hit within days.

Reported Indian incidents

Police disclosures and media reports, Aug–Oct 2026 · amounts marked ~ in reporting are approximate

Publicly reported cases total under a tenth of the sector-wide estimate, so most affected lenders have not been named.

Regional pattern. The same tooling class hit South Korean financial institutions (loan-inquiry and employee mobile systems) and 20 Japanese firms in retail, finance and logistics. Korean and Japanese intrusions centred on data theft and extortion. Indian intrusions centre on direct fund theft, a different monetisation path.

Attack chain and TTPs

The core trick is abusing trust, not breaking the gateway: once attackers hold valid partner-bank API credentials on a whitelisted server, the bank sees legitimate payout calls. Officials say operators spend 10–12 days mapping payment flows and whitelisted IDs before cashing out, then complete the theft in hours.

Kill chain (per CERT-In CIAD-2026-0046 and police disclosures)

Kill chain · CERT-In CIAD-2026-0046, Delhi Police IFSO, ET

Stage 3 is where defenders can still stop the loss: a payout with no matching approved record should never leave the server.

The follow-on risk is social engineering: attackers who hold borrower name, lender and loan amount can make convincing collection or “refund” calls.

Both named tools are open-source agentic pentest frameworks that let one low-to-mid-skill operator run recon, exploitation and post-exploitation through natural-language prompts. Neither is malware in the classic sense; they are dual-use orchestrators, so detection should target their infrastructure and behaviour, not file hashes.

Developer context. Team Cymru linked Ed1s0nZ to Knownsec 404’s StarLink project and a CNNVD reward listing that was later removed from the profile. That ties the author to China’s vulnerability ecosystem. It does not show that the NBFC operators are state-linked.

Why it matters for API fraud. These frameworks automate exactly the weaknesses CERT-In lists: unauthenticated or forgotten APIs, file-upload flaws, exposed admin panels and secrets in code. Speed is the change: CERT-In says access-to-impact dropped from days to hours.

Attribution assessment

Our best assessment is that several financially motivated crews are using commoditised AI pentest frameworks, with intrusions feeding a Chinese-run Telegram mule and USDT cash-out ecosystem (moderate confidence). Public evidence does not support a single actor across India, Korea and Japan, and nothing points to state direction.

Investigative leads. CrowdStrike recovered possible operator persona details from the Korea actor’s AI session files but could not confirm they belong to the operator. We do not reproduce them here.

Caveat. Tool origin is weak attribution evidence: CyberStrikeAI and ARTEX are public, and the Seoul case shows non-Chinese criminals using them too.

Indicators and hunting leads

No IOCs have been published for the Indian NBFC intrusions. The indicators below come from related ARTEX and CyberStrikeAI operations; use them for retro-hunting and infrastructure pivots, not as proof of involvement. Many are hosting or proxy IPs and will age quickly.

Network indicators (defanged)

Team Cymru’s full list of 21 CyberStrikeAI servers (Jan–Feb 2026) is reproduced in the Barrack write-up.

Infrastructure hunting pivots

CyberStrikeAI web banner, historically on TCP 8080; operators may change or suppress it.

ARTEX strings in served HTML, and exposed .claude/ directories, CLAUDE.md or agent session files on attacker hosts.

Hosting ASNs repeatedly seen: Tencent, Alibaba, Huawei Cloud, DigitalOcean, Vultr; plus Hong Kong VPS ranges.

Outbound traffic from production servers to LLM APIs or resellers (DeepSeek, Zhipu, xAI, xcai[.]pro) that the business does not use.

Behavioural detections for victims (high value, tool-agnostic)

Disbursal or payout API calls whose reference ID has no matching sanctioned loan record.

Burst patterns: 50+ IMPS/NEFT payouts within 90 minutes, especially to newly seen beneficiaries across many banks.

Payout calls that skip the preceding validation stages in the transaction flow.

New web shells or file writes in upload directories of API or app servers.

Log truncation, gaps in API gateway logs, or EDR agents stopped or tampered with.

Bank-side alerts on unusual debits from the disbursal account.

Defensive recommendations

The single highest-value control is server-side payout validation: reject any disbursal whose reference ID has no approved record, and enforce limits at the API layer. That alone defeats the core technique even if credentials are stolen. Priorities below follow CIAD-2026-0046, ordered by loss prevented per unit of effort.

Incident response. On detection: suspend affected APIs, disable compromised accounts, preserve forensic evidence, rotate every credential, and report to CERT-In/CSIRT-Fin ( [email protected] ) and RBI within six hours. Ask the partner bank to freeze recipient mule accounts immediately; police froze ₹1.7–1.8 crore in two cases this way.

Customer protection. Warn borrowers before vishing starts: tell them the lender will never ask for OTPs or payments to new accounts, and publish an official verification number.

Intelligence gaps and collection

The biggest gap is technical: no public IOC, malware family or initial-access CVE ties the Indian thefts to a specific operator or tool instance. Closing it will need infrastructure analysis, underground monitoring and the release of investigative findings.

Which CVEs or products gave initial access at Indian victims? CIAD-2026-0046 names none.

What evidence did agencies use to name CyberStrike in completed probes?

Is the ₹300 crore figure for two months or 18 months, and how many distinct institutions sit behind ~150 FIRs?

Are borrower datasets from victim NBFCs being sold or used for vishing?

What we are monitoring

New CyberStrikeAI and ARTEX infrastructure, especially hosts touching Indian networks.

Underground and Telegram sales of Indian NBFC borrower data, payment-API keys and mule accounts.

Payment-gateway and bank API keys leaked in public code repositories.

CERT-In Advisory CIAD-2026-0046 — CERT-In/CSIRT-Fin, 9 Oct 2026

Small NBFCs lose an estimated ₹300 crore… — Elets BFSI (citing The Economic Times), 29 Oct 2026

Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance — CrowdStrike, 7 Oct 2026

Malware attack on NBFC server drains ₹3.93 crore — Ministry of Cyber Affairs (independent news site), 28 Oct 2026

CyberStrikeAI: the AI attack platform behind the 600+ FortiGate breach — Barrack AI (synthesising Amazon, Team Cymru, Cyber and Ramen), 4 Mar 2026

CyberStrikeAI project page — DEV.co

日本企業への不正アクセス、中国のAIツール「ARTEX」使用を確認 — Impress Watch (GMO findings), 20 Oct 2026

Seoul police identify 7 suspects in ARTEX AI-assisted hacking spree — Daily Security Review, Oct 2026

Chinese AI models under scrutiny as cyberattacks target Indian financial firms — The420.in, Oct 2026

This report is based on open-source information available as of 30 October 2026. Figures attributed to media reports have not been independently verified by iZOOlogic. Indicators are shared for defensive hunting and may include shared or reassigned infrastructure.