AI-Powered Cyberattacks on NBFCs: ₹300 Crore Loss, CERT-In Alerts on Chinese AI Tools
How much it matters for each exam
1At a glance
Artificial Intelligence is being weaponized for sophisticated cyberattacks targeting Non-Banking Financial Companies (NBFCs) in India, leading to losses of around ₹300 crore. The nodal cybersecurity agency CERT-In has issued alerts, suspecting the use of Chinese AI toolkits, highlighting a critical vulnerability in financial sector cybersecurity.
AI Weaponized for Fraud
Cybercriminals are using AI tools to study company systems for 10-12 days before launching attacks, significantly reducing the time needed to breach security.
NBFCs Prime Target
Small NBFCs with weaker cybersecurity have been targeted, with one Delhi-based NBFC losing ₹7.5 crore and then ₹7.25 crore in subsequent attacks.
CERT-In Alert
India's nodal cybersecurity agency has advised organizations to strengthen defenses and prioritize alerts related to Chinese AI toolkits like Artex and CyberStrike.
2Facts to remember
Tap a card to see the answer. Try to recall it first.
3Detailed analysis
Context / Background
The financial sector, especially NBFCs, has been grappling with rising cyber threats. The integration of AI by malicious actors represents a paradigm shift, moving from brute-force attacks to intelligent, adaptive intrusions. This trend coincides with India's push for digital financial inclusion, which expands the attack surface for cybercriminals targeting less-secure entities.
Core Analysis & Implications
The attacks exploit a dual vulnerability: the relatively weaker cybersecurity infrastructure of smaller NBFCs and the enhanced capabilities provided by AI. AI allows for automated reconnaissance, spear-phishing in local languages (Hindi, Tamil), and rapid execution, compressing attack timelines from days to hours. The suspected link to Chinese-origin AI tools (CyberStrike, Artex, Qwen) adds a layer of geopolitical concern regarding the weaponization of commercial AI. Beyond direct financial loss, the breach of customer personal and financial data poses severe risks to privacy and can enable further social engineering attacks.
Future Outlook / Way Forward
Financial regulators like RBI may need to issue stricter cybersecurity mandates for NBFCs, especially those below a certain asset size. There will be increased focus on 'Red Teaming' exercises and adoption of AI-driven defense mechanisms. The incident underscores the urgent need for a national framework on secure and ethical AI development and usage, alongside enhanced international cooperation to curb the cross-border use of malicious AI tools.
4Background GK
Textbook concepts you need to understand this news
- CERT-In
- The Indian Computer Emergency Response Team (CERT-In) is the national nodal agency for responding to cybersecurity incidents as per the provisions of the Information Technology Act, 2000. It operates under the Ministry of Electronics and Information Technology (MeitY).
- NBFC (Non-Banking Financial Company)
- An NBFC is a company registered under the Companies Act, 2013, engaged in the business of loans and advances, acquisition of shares/stocks/bonds/debentures/securities issued by government or local authority or other marketable securities, but does not include any institution whose principal business is that of agriculture, industrial activity, purchase or sale of goods or providing services and sale/purchase/construction of immovable property. They are regulated by the Reserve Bank of India (RBI).
- Social Engineering
- In cybersecurity, social engineering is the psychological manipulation of people into performing actions or divulging confidential information. It is a common technique used in cyberattacks, such as phishing, where attackers pose as trusted entities.
5How exams will ask this
- Data: ~₹300 crore lost from NBFCs in ~2 months.
- Nodal Body: CERT-In (Indian Computer Emergency Response Team).
- Statistic: 8,502 NBFCs registered in India as of 15 October.
Don't make this mistake!
They may ask about the regulator of NBFCs (RBI) but provide SEBI or IRDAI as distractors. They might also swap the suspected toolkits (Chinese AI tools like CyberStrike) with generic terms like 'malware' or names of other cyber agencies like NCIIPC.
Write these in mains answers
Weaponization of AI, Financial Cybersecurity, Asymmetric Digital Threats
6Practice questions
Pick an answer, then read the explanation.
- Q1Easy
Which organization is the national nodal agency for responding to cybersecurity incidents in India, as mentioned in the article?
Explanation: The article explicitly mentions CERT-In as India's nodal cybersecurity agency that issued alerts regarding the AI cyberattacks. CERT-In operates under MeitY and is the primary agency for cybersecurity incident response.
- Q2Hard
Consider the following statements regarding the cyberattacks mentioned in the article:
- 1.The attacks have resulted in an estimated loss of around ₹500 crore from NBFCs.
- 2.The Indian Computer Emergency Response Team (CERT-In) suspects the involvement of Chinese AI toolkits like CyberStrike and Artex.
- 3.The attackers primarily target NBFCs with a turnover of more than ₹1,000 crore.
Which of the statements given above is/are correct?
Explanation: Statement 1 is incorrect: the estimated loss is around ₹300 crore, not ₹500 crore. Statement 2 is correct as per the article's mention of CERT-In's suspicion. Statement 3 is incorrect: the article states attackers target NBFCs with a turnover of about ₹1,000 crore or less, not more than ₹1,000 crore.
- Q3Medium
According to the article, approximately how many Non-Banking Financial Companies (NBFCs) were registered in India as of 15th October?
Explanation: The article specifically states that as of 15th October, 8,502 NBFCs were registered in India. The closest approximation among the options is 'Approximately 8,500'.
- Q4Medium
What is a significant new risk highlighted in the article regarding AI-enabled cyberattacks, beyond direct financial theft?
Explanation: The article explicitly states that the danger of cyberattacks extends beyond company bank accounts to customers' private and financial information. It explains how this data can be used for sophisticated social engineering attacks, making it a primary application-level impact.
7All sources
Original29 October 2026 · Read story
Related stories
Stories from the last 30 days on the same topic, state or exams
IIT Kharagpur to Establish India's First Physical AI School with ₹35 Crore Fund, IISER Pune and IIMs Adopt AI Policies
IIT Kharagpur is establishing India's first academic institution dedicated to Physical AI, funded with ₹35 crore, to advance interdisciplinary research in AI, physics, and engineering. Concurrently, premier institutes like IISER Pune, IIM Ahmedabad, and IIM Bangalore are formalizing institutional policies to integrate Generative AI into teaching, learning, and assessment, reflecting a strategic shift in higher education.
Full form of IISER: Indian Institute of Science Education and Research
India Approves CRISPR-edited Rice Varieties DRR Dhan 100 and Pusa DST Rice 1 for Higher Yield, Salt Tolerance
India is leveraging advanced genetic tools like CRISPR-Cas9 gene-editing to develop climate-resilient and high-yielding staple crops. In 2025, India became the first country to allow cultivation of gene-edited rice (DRR Dhan 100 & Pusa DST Rice 1), developed by public institutions for 20% higher yield and salt tolerance, aiming to secure food production amidst climate change.
First Gene-Edited Crop Approved: Rice (2025)
IIT Ropar Launches First 'Startup-Driven PhD' Model in India, Eliminating Traditional Thesis Requirement
The Indian Institute of Technology (IIT) Ropar has introduced a 'Product/Startup-Driven PhD' pathway, the first of its kind in any IIT, allowing research scholars to earn a PhD degree by developing a commercial product or startup instead of writing a traditional 200-300 page thesis. This model aims to link academic research directly to industry needs and real-world problem-solving.
Nodal Institute: Indian Institute of Technology (IIT) Ropar
ISRO's New-Age Space Technologies: NGLV (₹8,240 Cr, 30 Tonnes LEO), RLV Pushpak, Scramjet, and In-Space Docking
India is advancing its space capabilities with next-generation technologies like the reusable NGLV, electric and green propulsion, and autonomous in-space docking.
Full form of NGLV: Next Generation Launch Vehicle
Indian Patent Office Rejects TB Alliance's Patent on BPaL Regimen Under Sections 3(d), 3(e), 3(i)
The Indian Patent Office has rejected a patent application for the BPaL (Bedaquiline, Pretomanid, Linezolid) drug regimen for drug-resistant tuberculosis, citing lack of inventive step under India's Patents Act. This decision upholds key public health safeguards (Sections 3(d), 3(e), 3(i)) and concerns a WHO-recommended, six-month oral treatment. It is a significant development in India's fight against TB, which accounts for a quarter of global cases.
Full form of BPaL: Bedaquiline, Pretomanid, Linezolid
IIT Kharagpur to Launch First 'Physical AI' School in India with ₹35 Crore Investment
IIT Kharagpur is establishing India's first dedicated school focused on 'Physical Artificial Intelligence', with a total investment of ₹35 crore. The initiative aims to move AI beyond data-centric models to systems that interact with the physical world, integrating with engineering, science, and medicine. Courses are expected to begin from the next academic session.
Full form of AI: Artificial Intelligence