Indian NBFC Payment/Disbursement API Fraud — Trusted-Infrastructure Payout Abuse — Mobile Fraud Intelligence (MFI)
PASSغير مسجلة
التاريخ
٠١/١١/٢٠٢٦
الدومين
Mobile Fraud Intelligence (MFI)
الموضوع
Indian NBFC Payment/Disbursement API Fraud — Trusted-Infrastructure Payout Abuse
الحالة
PASS
النتائج المتحققة
لا يوجد
التناقضات والقيود
UNKNOWN: CERT-In/CSIRT-Fin confirmed multiple campaigns against NBFCs, digital lenders, fintechs, payment providers and wallet operators in which attackers compromise exposed applications/APIs or credentials, then invoke payout APIs from trusted infrastructure to bypass application-level controls and route funds to mule accounts.
حد الدليل: Official aggregate loss/victim denominator, one universal CVE/product, complete IOC set, one actor identity or universal AI/tool attribution.
UNKNOWN: CERT-In confirmed financially motivated abuse of open-source agentic offensive frameworks, machine-speed exploitation of conventional weaknesses and repeat attacks after incomplete remediation; BFSI entities are directed to payment/disbursement API controls in CIAD-2026-0046.
حد الدليل: That every payment-API incident used ARTEX/CyberStrike or one actor, or the NBFC scale/loss denominator.
ASSESSMENT: ET reported an estimated ~₹300 crore siphoned from mostly smaller NBFCs over roughly two months with nearly 150 complaints/FIRs, repeat attacks at some institutions and source-qualified references to CyberStrike/ARTEX-related tooling in completed investigations.
حد الدليل: Official CERT-In/RBI aggregate, one-campaign identity, universal AI/tool use or exact institution denominator.
UNKNOWN: Police-sourced reporting describes unauthorized access to an NBFC’s systems/API followed by 183 disbursements totaling ~₹3.3 crore to 52 suspected beneficiary accounts in 87 minutes; ~₹40 lakh was reportedly blocked.
حد الدليل: Same operator/infrastructure/exploit/AI tooling as other incidents or final root cause.
المتابعة المفتوحة
OPEN [HIGH]: SCALE_DENOMINATOR — Official consolidated count of affected institutions, successful incidents and confirmed monetary losses remains unavailable.
OPEN [HIGH]: TOOL_ACTOR_ATTRIBUTION — Evidence linking specific payment-API incidents to ARTEX, CyberStrike or a named operator remains incomplete/source-qualified.
OPEN [HIGH]: INITIAL_ACCESS_INFRASTRUCTURE — No complete public set of incident-specific initial-access CVEs/products, attacker infrastructure or IOCs was recovered.
OPEN [HIGH]: JORDAN_MENA_PROJECTION — No direct Jordan/MENA victim/provider/payment telemetry, matched infrastructure or authority reporting links this specific Indian payment-API campaign to the region.
المصادر
The Economic Timeshttps://economictimes.indiatimes.com/industry/banking/finance/ai-powered-cyberattacks-siphon-300-crore-from-small-nbfcs-in-two-months/articleshow/135278215.cms