Highly automated algorithms are threatening India’s digital finance landscape. This isn’t the work of traditional bank robbers. Over the past two months, a coordinated wave of cyberattacks has stolen an estimated ₹300 crore from various Non-Banking Financial Companies across the country.
Large banking institutions often possess fortified digital infrastructure. This helps them repel sophisticated intrusions. However, smaller NBFCs find themselves entirely outmatched. These are typically institutions with turnovers under ₹1,000 crore.
This is no longer a scenario of lone hackers manually testing firewalls. Instead, threat actors use accessible artificial intelligence to scale their operations. As a result, victims have filed nearly 150 police complaints across major financial hubs. These include Mumbai, Delhi, and Chennai.
The financial bleeding is severe. Some institutions suffered repeated attacks within days. This exposes a critical vulnerability. It highlights how smaller lending entities fail to secure their operating capital.
The Anatomy of an Automated Breach
Understanding this massive extraction of wealth requires looking closely at modern cybercriminals. They deploy new methodologies. Gone are the days when a hacker needed deep coding knowledge to breach a network.
Today, the process is frighteningly streamlined. Fraudsters typically begin with a quiet observation period. This lasts up to two weeks. During this time, they steal nothing.
They map the target NBFC’s internal systems by studying payment routing mechanisms, analyzing whitelisted employee network IDs, and scanning the underlying codebase for unpatched vulnerabilities.
In one stark example of how aggressive this can get, an NBFC in Delhi lost ₹7.5 crore in a primary breach, only to be drained of another ₹7.25 crore just days later because their compromised infrastructure was never properly secured.
According to a detailed investigation regarding this crisis at The Economic Times, authorities have found that perpetrators are heavily relying on platforms like CyberStrike alongside a combination of Chinese artificial intelligence toolkits.
By pairing specialized malware tools like Artex with open-source language models such as DeepSeek, Qwen, and Kimi, the attackers essentially automate the intrusion.
These tools are actively marauding financial systems globally, striking institutions from India to South Korea. A malicious actor simply drops a hacking toolkit into an AI model, provides a natural language prompt, and lets the autonomous agent do the heavy lifting to bypass security perimeters.
Weaponizing Stolen Data with Social Engineering
Once the network is compromised and the internal data is extracted, the attack enters its second phase, blending high-tech data theft with classic psychological manipulation.
The raw data stolen from these weak infrastructures ranging from customer names to specific loan amounts and lending history is immediately weaponized. Attackers use Large Language Models to draft highly convincing, culturally accurate phishing scripts in regional languages like Hindi or Tamil.
This creates a modernized, AI-backed version of the infamous Jamtara scams. Cybersecurity intelligence firms tracking these breaches are getting a firsthand look at how hackers and defenders are using AI, noting that machine learning is even being used post-theft to determine the best dark web marketplaces or encrypted messaging groups to fence the stolen information.
A customer might receive a phone call from someone who already knows their exact loan details. The caller speaks perfectly contextualized local dialects. The scam appears entirely legitimate.
A fundamental lack of cybersecurity awareness among smaller lenders drives this staggering ₹300 crore loss. Many registered NBFCs operate without knowing essential infrastructure requirements.
They also don’t know how frequently to conduct security audits. Smaller financial entities must rapidly upgrade their digital defenses.
They must also proactively warn customers about impending phishing attempts. Until then, automated syndicates will continue to exploit the weakest links in the financial chain.
