What Happened in the Latest NBFC Cyberattack Wave?

Cyberattacks against smaller NBFCs appear to have increased significantly in recent weeks.
According to information reported by The Economic Times, fraudsters have targeted
weaknesses in the cybersecurity infrastructure of smaller financial institutions.

The reported losses are estimated at approximately ₹300 crore, while nearly
150 complaints or first information reports have reportedly been registered across different
parts of India.

Importantly, the ₹300 crore figure should be treated as an estimated loss reported by
sources cited by The Economic Times, rather than as a final consolidated government
assessment.

Why Are Smaller NBFCs Being Targeted?

Investigators and cybersecurity professionals quoted in reports say that smaller financial
institutions may have weaker security infrastructure, outdated systems, insufficient monitoring
and gaps in cybersecurity processes.

The Economic Times reported that many of the affected institutions had turnover of around
₹1,000 crore or below. Attackers reportedly studied the operations of targeted organisations
before attempting to exploit weaknesses.

This highlights an important cybersecurity lesson: company size does not determine
whether an organisation is attractive to cybercriminals. Smaller financial companies
can become high-value targets when they control sensitive customer information and payment
systems.

Attackers Reportedly Study Their Targets Before Launching Attacks

One of the concerning aspects of the reported incidents is the level of reconnaissance allegedly
carried out before the attacks.

According to sources cited by The Economic Times, attackers may spend around
10 to 12 days analysing an organisation’s operations, including payment
processes, approved identifiers and potential weaknesses in software.

This type of reconnaissance is not necessarily a new hacking technique. What has changed is
the accessibility of AI-assisted tools that can potentially automate or accelerate parts of
the attack lifecycle.

How AI Could Change the Cybercrime Landscape

Artificial intelligence is increasingly becoming a force multiplier for cybercriminals.
Attackers can potentially use AI systems to analyse information, generate convincing phishing
messages, automate repetitive tasks and assist with reconnaissance.

Cybersecurity experts have also warned that AI can make social engineering more convincing.
For example, attackers who already possess information about a borrower could potentially use
that information to create highly believable phone scripts or phishing messages.

The danger is therefore not simply that AI creates completely new hacking techniques.
Instead, AI can make existing techniques faster, cheaper and easier to scale.

CyberStrike and Other AI Tools Mentioned in the Investigation

The Economic Times reported that investigators had identified a platform referred to as
CyberStrike in some cases where investigations had progressed. The report
also discussed AI toolkits including Artex and CyberStrike, along with
open-source AI models.

These claims remain part of ongoing investigations, and attribution should not be interpreted
as proof that every reported NBFC attack was conducted by the same group or infrastructure.

Cybersecurity investigations often evolve as forensic evidence, infrastructure records,
malware samples and financial trails are analysed.

CERT-In Warns That AI Can Reduce the Time Between Intrusion and Damage

India’s national cybersecurity agency, CERT-In, has also warned about the changing speed of
AI-assisted cyberattacks.

According to reporting on the latest incidents, organisations that fail to completely patch
or remediate vulnerabilities may face repeat attacks within a short period.

For financial organisations, this creates a major operational challenge. A vulnerability that
might previously have taken days to exploit could potentially be discovered, tested and abused
much faster when automated tools and multiple AI agents are involved.

Social Engineering Could Become More Dangerous

Technical hacking is only one part of the threat. Social engineering remains a major risk for
financial institutions and their customers.

A scammer who knows a customer’s name, lender and approximate loan information can potentially
make a fraudulent call sound much more credible.

AI can make this problem worse by helping attackers create convincing messages in regional
languages and personalise communication at scale.

Customers should therefore be particularly cautious about unsolicited calls claiming to be
from banks, NBFCs, loan providers or financial-service companies.

What NBFCs Should Do to Reduce Cybersecurity Risk

The reported attacks provide an important reminder that cybersecurity cannot be treated as a
one-time compliance exercise.

• Implement strong multi-factor authentication.
• Regularly patch operating systems, applications and APIs.
• Monitor unusual payment activity in real time.
• Use maker-checker controls for sensitive financial transactions.
• Regularly conduct vulnerability assessments and penetration testing.
• Review privileged accounts and access permissions.
• Rotate exposed credentials immediately.
• Monitor third-party and API integrations.
• Maintain tested incident-response and business-continuity plans.
• Conduct regular employee cybersecurity awareness training.
• Monitor customer accounts for unusual activity.
• Prepare a rapid process for reporting suspected cyber fraud.

Why This Matters for India’s Financial Sector

India’s financial ecosystem increasingly depends on APIs, digital lending platforms, mobile
applications, online payments and automated transaction systems.

That connectivity improves convenience and efficiency, but it also increases the potential
attack surface.

The latest incidents show why cybersecurity investment needs to keep pace with digital
transformation. Financial organisations must protect not only their internal networks but also
APIs, applications, employees, vendors, customers and payment workflows.

Customers Should Also Stay Alert

Cybersecurity is not solely the responsibility of financial institutions. Customers should
also take precautions.

• • Never share OTPs, PINs or passwords with callers.
  • Do not install applications suggested by unknown callers.
  • Verify suspicious loan or repayment messages directly with the lender.
  • Do not click unknown payment or login links.
  • Enable transaction notifications.
  • Report suspicious transactions immediately.
  • Use unique and strong passwords.
  • Enable multi-factor authentication wherever available.

Frequently Asked Questions

How much money was reportedly lost in the NBFC cyberattacks?

The Economic Times reported an estimated loss of approximately ₹300 crore over roughly two
months. The figure is based on sources cited by the publication and should not be treated as
a final consolidated official loss figure.

How many cyber fraud complaints have reportedly been filed?

Nearly 150 complaints or FIRs were reportedly filed in connection with the incidents described
in the report.

Why are smaller NBFCs being targeted?

Reports indicate that some smaller NBFCs may have weaker cybersecurity infrastructure,
insufficient monitoring or vulnerabilities in applications and payment processes.

Does AI make cyberattacks more dangerous?

AI can potentially accelerate reconnaissance, social engineering, content generation and other
parts of cybercrime. Its major impact may be increasing the speed and scale at which existing
attack methods can be used.

What should NBFCs do immediately?

NBFCs should prioritise vulnerability remediation, MFA, API security, transaction monitoring,
credential protection, privileged-access management, independent security testing and incident
response preparedness.

Our Take: AI Is Changing the Economics of Cybercrime

The most important lesson from this incident is not simply that artificial intelligence is being
used by cybercriminals. The bigger concern is the possibility that AI can lower the technical
and operational barriers required to conduct attacks at scale.

For financial companies, this means cybersecurity teams cannot rely solely on traditional
perimeter security. Continuous monitoring, rapid patching, identity security, secure APIs,
employee awareness and strong transaction controls are becoming increasingly important.

The reported NBFC losses should therefore be viewed as a warning for India’s broader financial
ecosystem: the faster financial technology evolves, the faster cybersecurity practices
must evolve alongside it.

Sources and Attribution

Primary report:

The Economic Times – AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months

Additional reporting was reviewed for cross-checking the major claims and context, including
reports from Moneycontrol and BFSI/Elets. The figures and allegations in this article are
attributed where appropriate and may change as official investigations continue.