Breaches and incidents
CERT-In / CSIRT-Fin (India): attackers invoke NBFC and fintech payout APIs directly to drain funds
Advisory CIAD-2026-0046 (severity Critical) says CERT-In/CSIRT-Fin observed multiple campaigns against NBFCs, digital lenders, fintechs, payment service...
- Disclosed
- Verification
- Checked against a primary source
What happened
- Advisory CIAD-2026-0046 (severity Critical) says CERT-In/CSIRT-Fin observed multiple campaigns against NBFCs, digital lenders, fintechs, payment service providers and wallet operators in which attackers steal payment-gateway and partner-bank API credentials and call disbursal/fund-transfer APIs from the victims’ own whitelisted infrastructure, bypassing loan creation, KYC, sanction, beneficiary verification, balance and per-transaction limits, then move money over IMPS/NEFT to mule accounts. Example: a Hyderabad NBFC lost over Rs 3.3 crore in 183 unauthorised transfers to 52 accounts in 87 minutes on 19 Oct 2026; Telangana Cyber Security Bureau registered the case and blocked about Rs 40 lakh (Siasat, citing TOI).
- Initial access per CERT-In: exploited internet-facing apps and middleware; deprecated/unauthenticated APIs with unrestricted file upload; long-lived static API tokens hard-coded in source; forged commits in source repositories; plaintext credentials; no MFA. Post-compromise: web shells, log deletion, EDR tampering; possible AI-assisted tooling.
- Attacker: not named.
- Response: CERT-In recommends cryptographically binding multi-stage transaction flows, maker-checker on fund movement, rejecting reference IDs with no matching sanctioned record, API-stage ceilings, penny-drop beneficiary validation, egress allow-listing, 180-day logs.