{"event":{"id":"evt-20261106-crafty","dedupe_key":"rts_milestone:rts_finding_c7689fe9d5fc4ef4993649e9fb0628f1","event_type":"publication_or_official_action","title":"India CERT-In issues updated critical advisory on Crafty Falcon AI-assisted attacks against financial APIs","summary":"India's CERT-In/CSIRT-Fin published critical advisory CIAD-2026-0058 on 4 November 2026, updating an October 9 warning and reporting a continuing wave of intrusions against fintech, non-bank lenders and payment providers. Its incident-based assessment describes misuse of cloud management, shared staging-to-production credentials, modified client packages and AI-enabled offensive tools. The authority's findings and claimed attacker toolchains are not a public independent forensic reproduction, state attribution or proof that every attack step was autonomous. November 4 dates the new escalation advisory, not the campaign's origin.","occurred_at":"2026-11-04T00:00:00.000Z","published_at":"2026-11-04T00:00:00.000Z","observed_at":"2026-11-06T17:49:47.442Z","reconstructed_at":null,"ingest_type":"live_evidence_only","locations":null,"status":"verified","confidence":0.93,"metadata":{"rts_finding_id":"rts_finding_c7689fe9d5fc4ef4993649e9fb0628f1","evidence_only":1,"source_bound":1,"epistemic_scope":"dated_observable_official_action_or_publication_only","no_relation_onset":1,"no_new_layer_state":1,"no_civilization_snapshot":1,"bounded_overlap_not_exhaustive":1},"created_at":"2026-11-06T17:57:19.229Z","updated_at":"2026-11-06T17:57:19.229Z"},"artifacts":[{"id":"art-20261106-crafty","dedupe_key":"6ebaf4fc6efa4aa087c6a02b52fa96be631906a55f3984f2b3dc72ffaf3ed318","canonical_url":null,"evidence_locator":"","artifact_type":"publication","title":"India CERT-In issues updated critical advisory on Crafty Falcon AI-assisted attacks against financial APIs","summary":"India's CERT-In/CSIRT-Fin published critical advisory CIAD-2026-0058 on 4 November 2026, updating an October 9 warning and reporting a continuing wave of intrusions against fintech, non-bank lenders and payment providers. Its incident-based assessment describes misuse of cloud management, shared staging-to-production credentials, modified client packages and AI-enabled offensive tools. The authority's findings and claimed attacker toolchains are not a public independent forensic reproduction, state attribution or proof that every attack step was autonomous. November 4 dates the new escalation advisory, not the campaign's origin.","creator_entities":[],"released_at":"2026-11-04T00:00:00.000Z","content_hash":null,"metadata":{"rts_finding_id":"rts_finding_c7689fe9d5fc4ef4993649e9fb0628f1","evidence_only":1,"source_bound":1,"epistemic_scope":"dated_observable_official_action_or_publication_only","no_relation_onset":1,"no_new_layer_state":1,"no_civilization_snapshot":1,"bounded_overlap_not_exhaustive":1},"created_at":"2026-11-06T17:57:19.221Z","updated_at":"2026-11-06T17:57:19.221Z","relation":"documents"}],"signals":[]}