Fraudsters siphoned off an estimated ₹300 crore from Indian non-banking financial companies (NBFCs) over a devastating two-month window ending in late October 2026. The sophisticated operation targeted smaller, vulnerable lenders with an annual turnover of ₹1,000 crore or less. The unprecedented breach highlights a dangerous escalation in financial cybercrime, exposing systemic technological vulnerabilities within India’s rapidly growing shadow banking sector.

Law enforcement agencies have been overwhelmed by the sudden geographic spread and velocity of the fraudulent activities. Approximately 150 complaints and First Information Reports (FIRs) have been filed across major economic hubs, including Delhi, Mumbai, and Chennai. Investigative units reveal that the highly coordinated campaign specifically weaponised cutting-edge artificial intelligence to bypass traditional defensive perimeters.

Intelligence reports have tied the orchestration of these digital heists to a notorious Chinese hacking platform known as CyberStrike. Instead of relying on manual coding and human deployment, the threat actors utilized highly automated, malicious frameworks to maximize damage. The scale of the operation indicates a massive, well-funded infrastructure designed specifically to exploit mid-market financial entities.

Central to the blitzkrieg was an advanced AI toolkit named Artex, which served as the operational brain of the campaign. Alongside Artex, hackers adapted popular, open-source AI large language models—including DeepSeek, Alibaba’s Qwen, Moonshot’s Kimi, and Zhipu’s GLM—to automate their code. This combination effectively put the entire hacking lifecycle on autopilot, allowing the software to think and react faster than human security teams.

The AI-driven tools systematically scanned the internet for defensive frailties, searching for unpatched software and exposed digital doorways. Once a vulnerability was detected, the AI automatically generated and delivered tailored exploits without requiring human intervention. This automated speed allowed the software to breach networks, compromise credentials, and initiate unauthorized fund transfers within minutes.

The relentless nature of the autopilot software resulted in devastating, repeated strikes against single institutions before they could recover. Companies found themselves entirely unable to plug systemic gaps in the wake of an initial breach. For example, a single Delhi-based NBFC was drained of ₹7.5 crore, only to be struck days later by the same automated script for an additional ₹7.25 crore.

The crisis has exposed deep structural flaws in how India’s smaller, fast-growing digital lenders manage their digital infrastructure. The aggressive push to expand digital retail lending over recent years severely outpaced the security frameworks needed to protect them. Investigators noted that a lack of cybersecurity maturity made these specific companies highly attractive, soft targets for automated exploitation.

A primary point of failure identified by forensic teams was the security surrounding digital loan disbursement Application Programming Interfaces (APIs). Many small NBFCs utilized weak authentication protocols to connect their internal platforms with mainstream partner banks. The automated AI tools easily hijacked these flawed APIs, using legitimate corporate credentials to authorize massive, fraudulent outflows from partner-bank networks.

Internal defensive governance at these targeted financial institutions was found to be dangerously obsolete. Most victim firms lacked basic continuous monitoring tools and next-generation firewalls capable of distinguishing legitimate user traffic from malicious AI bots. Furthermore, irregular and outdated security audit timelines meant known infrastructure vulnerabilities had been left open for months.

In response to the escalating threat, the Reserve Bank of India (RBI) and the Indian Computer Emergency Response Team (CERT-In) have issued urgent directives. Regulatory bodies are ordering the financial sector to immediately restrict exposed payment APIs and implement stringent multi-factor authentication. As AI rewrites the rules of financial fraud, smaller institutions must urgently upgrade their defenses or risk total collapse.