The Indian Computer Emergency Response Team (CERT-In) has disclosed that an artificial intelligence (AI)-assisted threat actor it tracks as Crafty Falcon is targeting organizations in the Banking, Financial Services, and Insurance (BFSI) sectors in the country.

Describing the threat as active and ongoing, the activity involves the use of publicly-available AI-driven offensive security tools like ARTEX, PentAGI, Cairn, and CyberStrikeAI.

«These tools execute complete attack chains autonomously at machine speed, generate and refine large numbers of tailored attack scripts in rapid succession, and adapt their payloads based on target responses,» CERT-In said. «The supporting attack infrastructure rotates IP addresses within hours to days.»

The agency said the attacks have also targeted cryptocurrency exchanges and digital asset service providers, resulting in the theft of keys and funds.

The update follows an October 2026 alert issued by CERT-In, which warned of multiple cyber attack campaigns targeting non-banking financial companies (NBFCs), digital lending platforms, fintech entities, payment service providers, and cryptocurrency wallet operators.

Threat actors have been observed exploiting internet-facing applications and exposed APIs and privileged endpoints to steal payment aggregator/gateway and partner-bank API credentials, and then invoke fund-transfer APIs directly from within the entities’ own allow-listed infrastructure.

Cybersecurity

Some of the other notable initial access vectors are listed below –

  • Use of stolen long-lived static, hard-coded API tokens
  • Supply chain compromise of source code repositories via forged commits
  • Exploitation of plaintext credentials in configuration files, source code, or databases
  • Access to applications and remote services lacking multi-factor authentication (MFA)

This approach, CERT-In added, defeats application-level controls such as loan creation, KYC, sanction, beneficiary verification, balance sufficiency, and per-transaction limits.

The rapidly executed fraudulent transactions are designed to move funds to attacker-controlled mule accounts across multiple banks. In addition, the attacks involve the operators taking steps to delete logs and tamper with endpoint security tools in an attempt to complicate detection and incident response efforts.

CERT-In also warned that attackers are targeting cloud infrastructure to execute commands and deploy malicious payloads, as well as publicly-accessible non-production environments to obtain shared credentials, tokens, or network paths, and then use them to pivot to production systems.

Other notable post-exploitation actions undertaken by the adversary are as follows –

  • Reverse-engineering application codebases to develop tailored exploits
  • Initiating unauthorized API calls using modified application packages, undermining controls that «assumed only the legitimate client application would call the APIs»
  • Executing micro-value test transactions (such as Rs. 1) to validate unauthorized fund flows before executing large-value transfers
  • Abusing merchant settlement APIs of payment aggregators to move funds
  • Exploiting newly disclosed vulnerabilities, including file-upload and deserialization exploit chains leading to web shells in PHP and Node.js applications
  • Creating a large number of custom scripts on the fly and iteratively improving them in quick succession, a pattern consistent with AI-assisted development

The development comes as CERT-In has published the Artificial Intelligence Security Auditing Guidelines, laying out specific requirements to ensure the «governance, security, privacy, fairness, transparency, resilience and auditability of AI systems.»

The framework calls for testing an AI agent’s documented identities, authorized objectives, approved tool use, permission boundaries, and its adherence to the principle of least privilege (PoLP). It also requires AI agents to require human approval for consequential actions, while ensuring high-risk AI systems incorporate emergency interruption, credential revocation, and controls for preventing automatic restarts.

«Effective assurance requires organisational accountability, technical testing, data and model governance, continuous monitoring, human oversight, incident response and third-party assurance,» the agency said. «Accordingly, the framework provides auditable requirements proportionate to the nature, scale, autonomy and potential impact of each AI system.»

Copycat ARTEX Version Hands Out Root Shell

The abuse of open-source penetration testing tools like ARTEX in real-world intrusions prompted its developer to take down the repository from GitHub. But multiple copies have sprung up on the Microsoft-owned code-hosting platform to fill the void –

  • github[.]com/trhhubsd/ARTEXX
  • github[.]com/mhtsec/ARTEX («mianhuatang11/artex» on Docker Hub)
  • github[.]com/RuoJi6/ARTEX

The first two GitHub repositories are no longer available for download. According to an independent cybersecurity researcher who goes by the online alias Badbyte, the «trhhubsd/ARTEX» repository was starred 2,449 times and forked over 600 times.

What’s notable about the GitHub copy is that it changed a single line in «docker-compose.yml» to pull the «tomicdd/artex» image from Docker Hub. The modified version conceals a new routine that grants a root shell during an unauthenticated request to the login endpoint. Per statistics shared by Docker Hub, the image has been downloaded 9,000 times.

«It adds a hidden verifyCaptcha() function to the login handler: if the CAPTCHA field starts with a secret marker, the rest runs through sh -c as root and the output is returned, before any credential check,» the researcher said in a statement shared with The Hacker News via email. «That’s an unauthenticated root shell on every install, and it never shows up in a code review.»

«A compromised ARTEX instance holds its targets’ unpatched findings, live credentials, captured sessions and network position. Whoever holds the backdoor can also quietly change what the agents do on the next run.»

Cybersecurity

As many as 62 ARTEX consoles on the internet have been found to serve the backdoored build between November 2 and 4, 2026, with the first instance going up by October 20, 2026, twelve days after the Docker image was pushed. Of these, 26 consoles are located in the U.S., followed by 17 in Hong Kong and seven in China.

In all, a total of 1,645 hosts have been found serving the ARTEX console as of November 4, 2026. Besides «tomicdd/artex,» a number of Docker Hub namespaces have been identified as publishing images named «artex.» Some of them are listed below –

  • congdonglinux/artex (also backdoored and identical to «tomicdd/artex»)
  • mianhuatang11/artex
  • autumn26/artex
  • andy1099zz/artex
  • dgddw/artex
  • trhhubsd/ARTEX
  • ylh440104/artex

«The backdoor’s author needed nothing more. The people they were after had already chosen to run an unvetted attack tool as root on an open port,» Badbyte said. «We know ARTEX has been used maliciously in the wild, and it will keep being used that way. We also know that plenty of legitimate, curious people installed it to see what the fuss was about. They did not sign up for a root shell on their own server.»