The Indian Computer Emergency Response Team (CERT-In) issued a critical advisory on October 9, 2026, warning fintech firms, non-banking financial companies (NBFCs), digital lending platforms, payment service providers, and wallet operators about coordinated cyberattacks that bypass Know Your Customer (KYC) processes through API hijacking. These attacks have led to unauthorized fund transfers, with AI tools possibly used to facilitate the breaches, according to medianama.com.
CERT-In and its cybersecurity arm CSIRT-Fin detailed that threat actors compromise internet-facing applications, exposed APIs, and privileged endpoints to steal credentials of payment aggregators, gateways, and partner banks. Attackers then invoke disbursal or fund-transfer APIs directly from the entities’ whitelisted infrastructure, bypassing application-level controls such as loan creation, KYC verification, sanction checks, beneficiary verification, balance sufficiency, and transaction limits, the advisory states.
This form of attack represents a significant escalation in cyber threats targeting financial services, as it exploits trusted API connections to circumvent traditional security measures. The use of AI tooling to automate or enhance these attacks underscores growing risks for fintech and NBFC sectors, which have increasingly relied on digital platforms and APIs for customer onboarding and transactions. CERT-In’s warning highlights the need for enhanced security protocols around API access and monitoring.
The advisory does not disclose the number of incidents or the amount of money lost but classifies the threat as critical. Financial entities affected by this advisory are expected to review and strengthen their API security measures promptly, as the next CERT-In update is anticipated to provide further guidance on mitigating these AI-driven API hijack attacks.