How AI agents are finding exposed credentials and forgotten APIs at machine speed, and why the payment stage is where lenders and fintechs must prove their controls
In October 2026, CERT-In issued two Critical advisories within a week of each other. Neither describes a new exploit. Neither depends on malware. Both describe attackers walking in with valid credentials and moving faster than most security teams are built to respond.
The first, CIAD-2026-0049, reports AI agents reading business records and personal data inside Indian organisations, using keys left in code and configuration. None of the affected organisations noticed. The second, CIAD-2026-0046, reports stolen payment-aggregator and bank API credentials being used to call disbursal APIs directly and send funds to mule accounts.
Read together, they describe one chain: from an exposed key to a completed fund transfer, in hours rather than days. For any BFSI or fintech business, that chain ends at the money.
AI agents reached live systems without anyone noticing. CIAD-2026-0049, issued on 15 October, covers disclosures from AI model providers. Their models, during research and evaluation, reached Indian organisations' systems and read confidential records using exposed credentials and permissive cloud roles. Every case was disclosed by the AI provider. Not one was caught by the organisation it happened to.
Attackers are running open-source agentic offensive tools at scale. The same advisory describes financially motivated groups using rebranded AI-native offensive frameworks across many countries. Agentic tooling cut the time from initial access to impact from days to a few hours. Multiple agents ran in parallel. Victims that remediated incompletely were hit again within days, at greater scale.
The weaknesses are conventional. Keys in source code and repository history. Dormant and test APIs still reachable from the internet. Payment keys stored in plaintext. Cloud and backend roles that let anonymous callers read and write. Admin interfaces exposed without MFA. CERT-In notes that AI found and used these faster and more exhaustively than human attackers.
Payment APIs are being abused for direct fund transfers. CIAD-2026-0046, issued on 9 October with CSIRT-Fin, targets NBFCs, digital lenders, fintechs, payment service providers and wallet operators. Attackers planted web shells, stole aggregator and partner-bank API credentials, and called disbursal APIs from the victim's own whitelisted servers. That bypassed loan creation, KYC, sanction, beneficiary verification and balance checks. Funds moved by IMPS and NEFT to mule accounts across banks and were withdrawn immediately. Logs were deleted and EDR was tampered with.
CIAD-2026-0049 explicitly asks BFSI and fintech entities to apply the payment API measures in CIAD-2026-0046 as well. They are one problem, and they need one response.
Mapped to MITRE ATT&CK, the two advisories describe the same progression from exposure to fund transfer.
Stages 1 and 2 change with every exposure. Stages 4 to 7 are behaviours the attacker cannot avoid. That is where detection has the best chance, and stage 6 is where the evidence sits outside the attacker's reach.
There is no signature to match. A valid key making valid API calls looks like business as usual. The only signals are a known credential used by an unknown caller, or a read pattern no legitimate client would produce.
Thresholds are tuned for one human attacker. Per-IP rate limits miss parallel agents spread across many addresses. Behaviour has to be grouped by credential, fingerprint and target, not only by source IP.
IP allow-listing protects nothing once your server is the caller. In the payment campaigns, disbursal requests came from the victim's own whitelisted infrastructure. The bank saw a trusted source. Application-layer controls were never in the path.
The evidence gets erased. Attackers deleted and truncated logs and tampered with EDR. A silent server looks the same as a quiet one unless someone is watching for the silence.
A weekly hunt is too slow. CERT-In reports compromise-to-transfer time shrinking sharply. If payout anomalies are only reviewed in a periodic hunt, the money has already left. Those checks need to run as near-real-time detections.
Close the doors first. Every weakness CERT-In lists can be checked today. Scan full repository history for secrets, not just the current code. Remove privileged keys from client apps. Retire dormant APIs. Lock down anonymous cloud and backend roles. Enforce MFA on every admin, payment and remote-access path. This is the cheapest part of the response and often the most decisive.
Treat every exposed key as already harvested. Rotating a leaked credential is not enough. Check how it was used over the past 180 days, and keep revoked keys on a watchlist so their reuse raises an alarm.
Prove the payment stage cannot be skipped. Try calling the disbursal API directly with valid service credentials, as an attacker on your own server would. Every attempt should be rejected at the payment stage itself, with stage binding, payout validation against approved records, ceilings at the API, and maker-checker in place.
Reconcile against evidence the attacker cannot delete. Your aggregator's and bank's records of what was actually paid sit outside your estate. Matching every payout to an approved sanction, in near real time, catches what deleted logs would hide.
Keep logs where attackers cannot reach them. Ship logs off-box, retain them for at least 180 days as CERT-In requires, and alert when a source goes quiet.
Govern your own AI agents. Give each agent run a short-lived, least-privilege identity, restrict its outbound access, and keep a tamper-resistant record of what it does. An internal agent with a broad token can cause the same incident from the inside.
Verify every fix from outside. CIAD-2026-0049 asks for remediation to be confirmed externally. "Remediated" is a claim to test, not a status to accept.
Attacks that run on valid credentials at machine speed cannot be answered with periodic reviews and alert queues. Netenrich Autonomous Security Operations (ASO) is built for this tempo, and delivers its See it and Prove it side: a continuous view of your Attack surface, Controls and Threats (ACT), assessed together.
Controls drift, and threats move faster. A control that passed last quarter's audit can fail today. A new partner integration adds an API key. A pipeline change exposes a secret. A log source quietly stops shipping. CERT-In's advisories show attackers coming back within days to test whether the fix held. An assessment run once a year measures a state that no longer exists.
Assessment has to start from the threats that matter to you. A lender's exposure to disbursal API abuse is not a retailer's exposure. Testing every control against every technique produces noise. Testing your controls against the campaigns targeting your sector right now shows which gaps an attacker would actually use, and what to fix first.
|
ACT dimension |
What Netenrich assesses |
What it answers for these advisories |
|---|---|---|
|
Attack surface |
Partner and payment APIs, service accounts, tokens and other non-human identities, exposed secrets and dormant APIs, mapped to the crown-jewel systems each can reach |
Which exposed key or forgotten API gives an agent a path to your disbursal API |
|
Controls |
Whether your identity, API, logging and detection controls deliver the coverage they promise, tested with simulated adversary techniques such as credential misuse by a service account |
Whether a direct disbursal call is rejected, and whether the telemetry that would reveal it reaches your SOC |
|
Threats |
Live campaigns targeting institutions like yours, correlated to the exposures and control gaps you actually have |
Which of the behaviours CERT-In reported apply to you, and in what order to close them |
Findings are mapped to compliance requirements and kept current on a live dashboard. Readiness for CERT-In, RBI or an auditor becomes something you can show at any point, not a file assembled before an inspection. Every remediation is re-verified from outside, as CIAD-2026-0049 asks.
Faster resolution from detection. Netenrich draws on the same signals Resolution Intelligence Cloud™ collects across identity, cloud, API, host and payment telemetry. When a hunt or detection fires, analysts start with the exposure, the control gap and the threat already in context, not a raw alert. That shortens the path from first signal to containment while the attacker is still moving.
If a valid payment key were used from your own server tonight, would you see it before the money reached a mule account?