New security assessment highlights deepfakes, identity attacks, supply-chain risks and weaknesses beyond traditional compliance systems

India’s banking, financial services and insurance (BFSI) sector is facing a rapidly changing cyber threat environment as attackers increasingly use artificial intelligence, deepfake technology, identity manipulation and advanced digital techniques to target financial systems.

A new Digital Threat Report 2025-26 developed by SISA, CERT-In and CSIRT-Fin warns that cyber risks are evolving faster than many organisations can strengthen their defences. The report highlights that modern attacks are no longer limited to stealing information but are increasingly focused on disrupting transactions, compromising trust and exploiting digital infrastructure.

The assessment notes that several cyber trends predicted in the previous edition of the report have already become widespread, showing that the time between emerging threats and real-world attacks is becoming significantly shorter.

Deepfakes and AI Increase Sophistication of Financial Fraud

Artificial intelligence has become a major factor behind the growth of sophisticated cyber fraud campaigns. The report identifies AI-driven impersonation, deepfake videos, automated phishing and advanced social engineering as key challenges for financial institutions.

Criminal groups are increasingly using realistic fake identities, manipulated communications and AI-generated content to deceive employees and customers. Traditional verification methods based only on visual or voice recognition are becoming less reliable as attackers improve their ability to imitate trusted individuals.

The report also highlights rising risks from business email compromise, credential theft and session hijacking. Attackers are using stolen access details and legitimate user sessions to bypass security measures instead of directly breaking authentication systems.

Cyber incidents affecting India’s BFSI sector are estimated to be significantly higher than the global average, with reported incidents increasing substantially in recent years. The report stresses that organisations must focus on analysing user behaviour, device activity and transaction patterns rather than relying only on passwords or authentication checks.

Identity Protection Becomes a Critical Security Challenge

Cybercriminals are increasingly targeting digital identities after successful login attempts. The report warns that attackers are focusing on session tokens, application programming interface (API) keys, service accounts and cloud-based permissions.

In these situations, security systems may not detect a traditional authentication failure because attackers are operating through valid sessions or stolen credentials. Financial institutions are therefore being urged to strengthen identity monitoring and continuously review access privileges.

The report recommends improved management of non-human identities, stronger credential protection and better visibility into digital activity across applications and cloud environments.

Compliance Alone Cannot Guarantee Cyber Resilience

The report highlights a growing gap between meeting regulatory requirements and achieving real-world cybersecurity readiness.

While compliance frameworks help organisations establish security standards, they may not always reveal weaknesses that appear during active attacks. The report identifies issues such as outdated security practices, incomplete monitoring and gaps between designed controls and their actual operation.

For example, encryption may protect stored information but may not secure data while it is being processed. Multi-factor authentication can confirm identity but may not stop attackers who have already gained access through stolen sessions.

The report advises financial organisations to treat compliance as a starting point rather than a complete security solution. Continuous testing, threat simulations, behavioural monitoring and regular security reviews are recommended to strengthen resilience.

Business Logic Attacks and Hidden Threats Expand Risk

Modern attackers are increasingly exploiting weaknesses in how financial systems operate rather than simply attacking technical vulnerabilities.

The report warns that payment systems, transaction limits and verification workflows can be manipulated through unusual sequences of legitimate actions. Attackers may abuse authorised functions in ways that developers never intended, making such activities difficult to detect.

It also highlights threats from fileless malware, encrypted communication channels and incomplete monitoring systems. These techniques can allow attackers to remain hidden while moving through networks or extracting sensitive information.

Report Calls for Continuous Cyber Defence Strategy

The assessment outlines several major security challenges expected to shape the future threat landscape, including AI-powered fraud, identity compromise, payment manipulation, supply-chain attacks and risks affecting critical financial infrastructure.

To address these challenges, the report recommends an 18-month security improvement roadmap focused on strengthening basic protections, expanding monitoring capabilities and redesigning security architecture.

The report concludes that cybersecurity must become an ongoing business priority for financial organisations. In an environment where cyberattacks can scale rapidly through automation and AI, periodic security checks are no longer enough. Continuous protection, testing and adaptation will be essential to maintaining trust and stability in the financial sector.

Firmware vulnerability allows rapid password recovery on affected Dell devices, raising concerns over enterprise hardware security

A newly disclosed security vulnerability in the BIOS firmware of several Dell devices could allow attackers to recover administrator and user BIOS passwords within seconds, according to cybersecurity researchers.

The flaw, identified as CVE-2026-40639 and documented in Dell’s security advisory DSA-2026-197, is linked to an insecure password storage method inside certain firmware components. Rather than exploiting weak passwords, attackers can take advantage of how BIOS credentials are encrypted and stored.

Although exploitation generally requires physical access to the affected device or low-level system access, successful attacks could bypass important firmware security protections that help secure the boot process.

Faulty Encryption Method Exposed BIOS Credentials

Researchers found that some Dell systems stored BIOS passwords using a weak repeating-key XOR encryption method instead of a stronger cryptographic protection mechanism.

The affected passwords are stored in the Dell Variable (DVAR) section of the SPI flash memory, where firmware settings are maintained. According to researchers, weaknesses in the encryption design allow sensitive key information to be recovered from stored password data.

The problem is particularly serious for shorter passwords because unused storage space in the encrypted password field can reveal portions of the encryption key. This enables attackers to recover passwords directly instead of attempting traditional password-cracking methods.

Even longer passwords may remain vulnerable because the system’s key-generation process relies on limited device-specific information, reducing the complexity required for recovery.

Researchers Identify Affected Dell Platforms

The vulnerability was discovered by security researchers Craig S. Blackie of MDSec and Darren McDonald of AmberWolf during an investigation into Dell UEFI firmware.

Their analysis identified issues in the SystemPwSmm firmware component, which is used across multiple Dell client systems. Testing confirmed exposure on devices including:

• Dell Latitude E7250
• Dell Latitude 7490
• Dell XPS 15 9560
• Dell Wyse 5070 thin client

Researchers noted that newer Dell platforms using the Security Information Vault Block design with SHA-256-based protection were not affected during testing.

The difference highlights that Dell has already implemented stronger firmware security methods on newer hardware, although some older systems remain dependent on the vulnerable design.

Attack Requires Access, But Impact Could Be Significant

The vulnerability is not considered a remote attack because hackers typically need physical access to a device or the ability to obtain a firmware image from the system.

However, once attackers gain access, recovering BIOS passwords can reportedly be performed without user interaction or authentication. This creates risks for corporate laptops, shared devices and systems used in environments where physical security cannot always be guaranteed.

BIOS passwords often protect settings related to Secure Boot, boot order changes and other pre-operating system controls. If compromised, attackers could potentially weaken security protections or interfere with systems protected by disk encryption technologies.

Security experts warn that firmware-level weaknesses are particularly dangerous because they operate beneath the operating system and can affect multiple layers of device security.

Dell Releases Updates and Advises Security Measures

The vulnerability was privately reported to Dell in March 2026. After reviewing the findings, Dell published its security advisory and began releasing firmware updates for affected product lines.

Initial updates covered several platforms, including Precision systems, Rugged Latitude devices, Embedded PCs and Edge Gateway products. Additional fixes for other affected models were expected as part of Dell’s broader remediation effort.

The Uttarakhand Special Task Force (STF) has successfully dismantled a sophisticated cybercrime network involved in financial fraud through “mule accounts,” arresting three individuals in the state’s first-ever Bharatiya Nyaya Sanhita (BNS) cybercrime case.

The operation, conducted in Haridwar following detailed intelligence and technical analysis, led to the seizure of multiple bank passbooks, chequebooks, debit cards, PAN cards, Aadhaar cards, and forged bank seals used to perpetrate large-scale financial fraud.

Exploitation of Vulnerable Individuals

Authorities revealed that the gang targeted unsuspecting individuals, persuading them to open bank accounts under false pretences. These “mule accounts” were subsequently handed over to organized cybercriminal syndicates to facilitate the transfer of illicit funds across multiple states.

“These accounts enabled the siphoning of lakhs of rupees from victims nationwide,” said a senior STF officer. “The network relied on carefully forged documents and official-looking seals to make the transactions appear legitimate.”

Legal Action Under BNS and IT Act

The three arrested suspects have been charged under Sections 111, 318(4), and 61(2) of the BNS, as well as Section 66D of the Information Technology Act, at Dehradun Cyber Police Station.

“This marks the first instance in Uttarakhand of applying Section 111 of the BNS law in a cybercrime context. The provision targets organized criminal networks and carries penalties of up to 10 years imprisonment,” an STF official explained.

Authorities highlighted that the new legal framework significantly strengthens the state’s ability to prosecute organized digital crime, ensuring that perpetrators face stringent consequences.

Ongoing Investigation and Manhunt

The STF confirmed a continuing investigation to identify additional members of the network. Officers are analyzing digital devices and tracing fund flows to uncover the full extent of the criminal operation.

“This was a well-coordinated interstate network. Our focus is to ensure all responsible parties are held accountable,” a police spokesperson stated. Investigators are also reviewing recruitment tactics used to manipulate innocent individuals into assisting the syndicate.

Expert Advisory for Citizens and Investors

Cybersecurity experts warn that social engineering tactics, such as mule accounts, pose serious financial risks. Prof. Triveni Singh, former IPS officer and cybercrime specialist, emphasized, “Investors and citizens must verify the legitimacy of any request to open accounts. Immediate reporting of suspicious activity can prevent significant losses.”

Authorities urge the public to remain vigilant and cooperate with law enforcement to curb digital fraud. Timely action can protect both personal finances and broader economic security.

STF’s Commitment to Combating Cybercrime

The STF reaffirmed its commitment to combating organized cybercrime through proactive operations, technical intelligence, and inter-state coordination. Officials stressed that legal reforms like the BNS and specialized cyber units are critical in safeguarding citizens’ financial transactions.

“Exploiting innocent people for financial gain will not be tolerated,” said an STF spokesperson. “With public cooperation and continued vigilance, we aim to dismantle such criminal networks entirely.”