Scale of Losses and Targeted Institutions
Approximately ₹300 crore was siphoned from non-banking financial companies (NBFCs) through cyberattacks over the past two months, according to reports citing highly placed sources. Nearly 150 complaints or first information reports were filed regarding these incidents.
The attacks have primarily targeted smaller NBFCs with turnovers of about ₹1,000 crore or below, exploiting frailties in their cybersecurity infrastructure. The frequency of these cyberattacks became rampant over the last one and a half months.
Specific financial losses include an NBFC in Delhi that lost ₹7.5 crore in a first attack and another ₹7.25 crore days later. As of October 15, 8,502 NBFCs were registered with the banking regulator. Complaints regarding these cyber incidents included about 30 in Mumbai, over 25 in Delhi, and 15-16 in Chennai.
Identification of Chinese Hacking Platforms
Cybersecurity agencies have identified the Chinese hacking platform CyberStrike as the perpetrator in completed probes. Investigations into other cases are ongoing.
Experts told The Economic Times that a combination of two Chinese AI toolkits—Artex and CyberStrike—alongside open-source models such as DeepSeek, Alibaba’s Qwen, Moonshot’s Kimi, and Zhipu’s GLM have been targeting financial systems in India, Japan, and South Korea.
Automated Social Engineering and Pre-Attack Reconnaissance
The sophistication of these attacks relies heavily on automated processes. An official tracking developments explained that attackers use AI models with prompts to automate hacking, facilitating Jamtara-style social engineering techniques against vulnerable NBFCs.
Before launching an attack, fraudsters analyze an NBFC’s functioning for 10-12 days to study payment methods, whitelisted IDs, and code infirmities. This reconnaissance phase allows them to tailor their approach effectively.
Mandar Patil, executive vice president of Cyble, stated that large language models can script phishing calls in fluent Hindi or Tamil using stolen data, such as names, lenders, and loan amounts. This capability enhances the credibility of the social engineering aspect of the heists.
Accelerated Damage and Regulatory Warnings
India’s nodal cybersecurity agency CERT-In said AI frameworks have reduced the time from break-in to damage to hours. The agency advised organizations to prioritize alerts on ARTEX and CyberStrike.
CERT-In noted that tools like Artex and CyberStrike make it easier to generate targeted lures, clone or spoof mobile apps, and chain social engineering with technical exploitation at scale.
The impact of these breaches extends beyond NBFCs. State Bank of India sent advisories to customers impacted by a breach that leaked a dataset of 375,000 records on the dark web.
Global Implications and Data Trafficking
The scope of these AI-driven attacks is not limited to India. Cyble found that in a recent South Korea attack on a loan inquiry service, the attacker used AI to determine where to sell stolen data and which Telegram groups traded in it.
This indicates a coordinated effort to monetize stolen information through international dark web markets, leveraging AI to identify the most profitable channels for data trafficking.