AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months

New Delhi | Mumbai: About ₹300 crore is estimated to have been siphoned off by fraudsters from non-banking financial companies (NBFCs), mostly smaller ones, across India through cyberattacks in the past two months or so with nearly 150 complaints or first information report (FIRs) having already been filed, highly placed sources told ET.

"Cyberattacks used to happen earlier also but for the past one and a half months, they have become rampant, with some companies witnessing repeated attacks," said one of the persons cited. In Delhi, one NBFC lost ₹7.5 crore in a first attack and another ₹7.25 crore a few days later, said the people.

The raids have exploited the frailties of the weaker cyber security infrastructure at these NBFCs, largely those with a turnover of about ₹1,000 crore or below, the people said.

Jamtara-style Techniques

Cybersecurity agencies have been working round the clock to tackle the situation, advising the NBFCs to upgrade infrastructure at the earliest.

The agencies have found Chinese hacking platform CyberStrike to be the perpetrator in the few instances where probes have been completed as they carry on investigating the other cases.

Experts told ET that a combination of two Chinese artificial intelligence (AI) toolkits-Artex and CyberStrike-alongside Chinese open-source models such as DeepSeek, Alibaba's Qwen, Moonshot's Kimi and Zhipu's GLM have been marauding financial systems in India and across the world with companies in Japan and South Korea also facing attacks.

Also Read: Punjab National Bank customers in Greater Noida allege Rs 35 crore fraud, several employees suspended

"Some small NBFCs don't know what infra should be there, what time the audits should be done and their systems are very weak," said an official aware of the investigation details. As many as 8,502 NBFCs were registered with the banking regulator as of October 15. Some 30 complaints have been filed in Mumbai, over 25 in Delhi and 15-16 in Chennai along with other cities, said the people cited. Complaints or FIRs related to cyber frauds are usually confidential due to the sensitivity of the matter.

Another official said the fraudsters start by analysing an NBFC's functioning for 10-12 days. They study the manner in which payments are made, an institution's whitelisted IDs, and any infirmities in the code before launching an attack.

While the hacking methods are not technologically advanced, access to them has now become much easier with the help of AI models and toolkits.

"One just needs to put the toolkit in the AI model and give a prompt, and the agent will do the hacking for you," said an official tracking developments. This paves the way toward creating the ground for Jamtara-style social engineering techniques at those NBFCs that are vulnerable, he said.

Also Read: Banks worry more about geopolitics than borrowing costs, survey shows

Cyber intelligence firm Cyble found that, in a recent attack in South Korea, one target was a loan inquiry service. After stealing the data, the attacker asked the AI where it could be sold and which Telegram groups traded in such information.

"A caller who knows your name, lender and loan amount sounds legitimate, and an LLM (large language model) can script the call in fluent Hindi or Tamil," said Mandar Patil, executive vice president, Cyble. Indian firms that have been hit should send warnings to customers before they start getting phishing calls, Patil added.

On Friday, State Bank of India sent advisories to individual customers who were impacted in a recent breach, which led to the leak of a dataset of 375,000 records on the dark web.

India's nodal cybersecurity agency CERT-In said these frameworks have slashed the time from break-in to damage to hours from days with multiple AI agents operating in parallel. Organisations that failed to patch weaknesses fully were attacked again within days, at greater scale. CERT-In has told organisations to alert their red teams to prioritise any alerts on ARTEX and CyberStrike.

These tools "make it easier to generate targeted lures, clone/spoof mobile apps or payment flows, and chain social engineering with technical exploitation at scale, raising the volume and sophistication of classic Indian phishing/mule-account operations targeting BFSI customers," said Manish Mimani, founder and chief executive of security firm Protectt.ai.