Pakistan's National Cyber Emergency Response Team (National CERT) has warned the country's banks and financial institutions that cybercriminals are now using artificial intelligence to hunt for weaknesses, steal login credentials and strike in coordinated waves.

The warning came in a new advisory issued on November 6, titled "Emerging AI-Enabled Cyber Threats Targeting Financial Institutions and OT/Critical Infrastructure". It says attackers are increasingly deploying AI alongside automated bots, botnets and agentic tools — software agents that can carry out multi-step tasks with little human supervision.

The advisory is one of the clearest signals yet that the threat facing Pakistan's digital economy has shifted from opportunistic hacking to automated, machine-speed crime.

Banks told to expect attacks on core systems

The warning is specific about where the danger lies. Banks could face attacks on core banking systems, digital banking platforms, payment gateways and the application programming interfaces (APIs) that connect them. Automated login attempts are the most immediate risk, alongside disruption of online banking services.

One scenario the advisory flags is the manipulation of the account balance a customer sees in a banking app — a tactic that could trigger panic even when the money itself has not moved. The advisory, numbered NCA-26.051126, does not describe an attack that has already happened at a Pakistani bank; it describes what institutions should be ready for.

Critical infrastructure in the crosshairs too

The warning extends well beyond banking. National CERT also highlighted risks to oil and gas facilities, power networks, water utilities, manufacturing plants and transportation systems — the operational technology, or OT, that keeps the country's physical infrastructure running.

Connected devices, industrial control systems and insecure remote access by outside contractors could let attackers disrupt physical operations. As an example of the physical damage such attacks can cause, the advisory cited recent incidents at European supermarkets that hit refrigeration and freezer systems — while noting that AI involvement in those incidents has not been confirmed.

What banks are being told to do

The recommendations are practical rather than theoretical. Financial institutions have been urged to enforce multi-factor authentication, tighten access controls, monitor their systems continuously and reconcile transactions independently — including integrity checks between customer-facing apps and core banking records.

The warning lands against a worrying backdrop. Only three days earlier, National CERT told a National Assembly committee that Pakistan has recorded more than 1,000 cyberattacks so far in 2026, and that the agency runs on a staff of just 70 people, with about 70 per cent of its threat-monitoring work still done manually.

India's Computer Emergency Response Team, CERT-In, issued its own advisory on November 4 about an AI-assisted campaign it calls "CRAFTY FALCON", targeting banks, non-banking finance companies, fintech firms and payment providers. The two advisories are separate, but they describe the same shift: AI is lowering the skill and effort needed to run a serious financial cyberattack, and the tools to do it are now publicly available.

By Hamza Faisal