India’s smaller Non-Banking Financial Companies (NBFCs) are facing a growing wave of cyberattacks, with scammers siphoning off an estimated ₹300 crore over the past two months. Nearly 150 complaints and First Information Reports (FIRs) have been registered in connection with the incidents.
According to a report published by The Economic Times, the attacks have primarily targeted smaller NBFCs with annual turnovers of approximately ₹1,000 crore or less. Several financial institutions have experienced repeated attacks, exposing weaknesses in their cybersecurity infrastructure and payment systems.
In one reported incident, a Delhi-based NBFC allegedly lost ₹7.5 crore in an initial cyberattack, followed by another loss of ₹7.25 crore just days later. Investigators believe that inadequate security controls and insufficient monitoring have made smaller lenders attractive targets for cybercriminals.
AI tools making cyberattacks easier
Investigations into some of the incidents have identified a Chinese hacking platform known as CyberStrike. Security experts have also raised concerns about the growing use of artificial intelligence-powered toolkits, including ARTEX and CyberStrike, alongside open-source large language models.
These tools are lowering the technical barriers for cybercriminals by automating reconnaissance, vulnerability identification and other stages of cyberattacks. Attackers can use AI-assisted frameworks to analyse targeted systems and identify weaknesses more efficiently.
According to officials familiar with the investigations, attackers typically spend around 10 to 12 days studying an NBFC's payment infrastructure, including transaction processes, whitelisted identification details and application code, before attempting to steal funds.
Experts have also warned that stolen customer information could be exploited for targeted phishing and social engineering campaigns. Scammers equipped with borrowers' names, loan details and lender information may impersonate financial representatives to deceive customers into sharing sensitive information.
CERT-In flags payment API vulnerabilities
India's national cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), along with CSIRT-Fin, issued a critical advisory on October 9, highlighting cyber threats targeting NBFCs, digital lenders, fintech companies and payment service providers.
The advisory identified vulnerabilities in applications and payment Application Programming Interfaces (APIs) that could allow attackers to steal banking credentials and initiate unauthorised fund transfers through trusted financial infrastructure.
CERT-In also warned that AI-driven attack frameworks have significantly reduced the time between initial system compromise and financial damage, allowing attackers to execute operations within hours rather than days.