Cyberattacks affect 20 financial institutions; CERT-In warns on API vulnerabilities and security measures

The attacks, which may have involved AI-assisted hacking tools, prompted a critical advisory from the Indian Computer Emergency Response Team (CERT-In), warning financial institutions to suspend compromised interfaces and strengthen transaction safeguards.

According to a person familiar with the incidents, a technology platform originally developed by a Chennai-based software company had vulnerabilities in its API controls that were allegedly exploited to siphon off funds. "The platform had deficiencies in its security architecture, particularly around payout APIs. These allowed transactions to be initiated without the checks that should ordinarily precede a disbursement, including customer verification," the person said.

The identity of the technology provider and the extent of financial losses could not be independently established.

In its October 9 advisory, CERT-In flagged multiple attacks in which hackers bypassed customer verification, loan sanction and payment authorisation controls to execute fraudulent transfers. The agency also identified indications of AI-assisted offensive tools being used alongside custom scripts, potentially allowing attackers to identify vulnerabilities and execute fraudulent transactions more rapidly.

Following the CERT-In warning, affected entities have moved to disable vulnerable interfaces, block unauthorised access and strengthen transaction controls, the person said.

"The immediate priority is to ensure that every payout is linked to a verified customer and an authorised transaction. Banks and fintechs will have to review their third-party integrations and ensure that security checks cannot be bypassed even when valid API credentials are used," the person said.

In its advisory, CERT-In said attackers were compromising internet-facing applications and stealing payment aggregator, gateway and partner-bank API credentials. These credentials were subsequently used to initiate transfers directly from financial institutions' own authorised infrastructure, bypassing application-level safeguards.

The fraudulent transactions involved fictitious loan references, payments exceeding prescribed limits and transfers to mule accounts across multiple banks. Funds were rapidly transferred through IMPS and NEFT channels and withdrawn, complicating recovery.

The agency also warned that attackers could exploit outdated APIs, unsecured application interfaces and credentials embedded in source code. Such vulnerabilities could allow attackers to circumvent conventional security checks even when institutions have controls at the application level.

CERT-In has advised financial institutions to suspend compromised APIs, rotate credentials, introduce multi-factor authentication and enforce maker-checker approvals for fund transfers.

It has also recommended real-time transaction monitoring, limits on fund transfers, beneficiary verification and reconciliation of payouts against approved loan or payment records.