Medianama:
CERT-In warns lenders and payment firms that attackers are bypassing KYC and transfer controls by using stolen credentials to call payment APIs directly
In a 9 October advisory rated “Critical”, CERT-In and CSIRT-Fin describe multiple campaigns targeting NBFCs, digital lenders, fintechs, payment providers and wallet operators. They recommend measures including multi-factor authentication and replacing long-lived tokens; the advisory gives no incident count or loss estimate.