Pakistan’s National Cyber Emergency Response Team has warned the country’s banks, financial institutions and critical infrastructure operators that AI-powered cyberattacks are now hunting for weaknesses, stealing login credentials and striking in coordinated waves. The warning, issued in a new advisory on 6 November 2026, is one of the clearest signals yet that the threat facing Pakistan’s digital economy has moved from opportunistic hacking to automated, machine-speed crime.
The advisory, titled “Emerging AI-Enabled Cyber Threats Targeting Financial Institutions and OT/Critical Infrastructure“, says attackers are increasingly deploying artificial intelligence alongside automated bots, botnets and agentic tools — software agents that can carry out multi-step tasks with little human supervision. Together, these tools let criminals scan systems for vulnerabilities, harvest passwords and strike at scale.
For ordinary account holders, the warning matters because the targets are systems they use every day. Banks have been told to expect attacks on core banking systems, digital platforms, payment gateways and application programming interfaces, the connectors that let apps and services talk to each other. The advisory flags automated login attempts, disruption of online banking and even the manipulation of account balances shown to customers — a tactic that could trigger panic even when the money itself has not moved.
Banks face AI-powered cyberattacks on core systems and payment gateways
The banking warning is specific about where the danger lies. Core banking systems sit at the heart of every bank, holding account records and processing transactions. Digital platforms and payment gateways handle millions of transfers, bill payments and online purchases each day. And APIs, which quietly move data between banks, fintech apps and merchants, have become a favourite target because a single weakness can open a path into the payment flow itself.
Automated login attempts are the most immediate risk. AI tools can test stolen usernames and passwords against banking apps far faster than a human ever could, adapting when a login fails and trying new combinations without pause. Successful attempts give criminals direct access to accounts; failed attempts in large numbers can still overwhelm systems and lock genuine customers out of their own money.
The advisory also warns that attackers could tamper with the balances customers see on screen. Even if no funds are actually stolen, a manipulated display can convince people their savings have vanished, setting off a wave of panic withdrawals and complaints while the bank is still under attack.
Power, water and transport systems are also in scope
The warning does not stop at banking. National CERT also highlighted risks to oil and gas facilities, power networks, water utilities, manufacturing plants and transport systems — the operational technology, or OT, that keeps the country’s physical infrastructure running.
These systems are vulnerable in different ways from banks. Industrial control systems, connected devices and third-party remote access all create entry points, and many were designed long before cybersecurity was a consideration. An AI-powered cyberattack that reaches them does not need to steal money: disrupting a power grid, a water supply or a transport network causes damage directly, and the consequences fall on the public rather than on a single company.
The advisory treats financial institutions and infrastructure operators as part of the same problem: the tools are the same, the attackers are the same, and the defences — constant monitoring, strict access control and the ability to keep operating when something goes wrong — are largely the same too.
What banks and operators have been told to do
National CERT’s recommendations against AI-powered cyberattacks are practical rather than theoretical. Financial institutions have been urged to enforce multi-factor authentication, tighten access controls, monitor their systems continuously and reconcile transactions independently, so a tampered balance is caught by a second check.
Critical infrastructure operators face a longer list. They have been told to secure their industrial systems, restrict direct exposure to the internet, keep their IT networks separated from their operational technology networks, and strengthen backups so a successful attack does not become a lasting outage.
Organisations have also been advised to review their preparedness against AI-powered cyberattacks specifically, to maintain proper security logs and to report suspected incidents through the relevant national cybersecurity channels. The message is that preparation cannot wait for an incident: by the time an AI-driven attack is visible, it is already moving at machine speed.
A regional pattern — and why Pakistan is exposed
The warning lands in a week when the same threat has surfaced across the border. India’s Computer Emergency Response Team, CERT-In, issued its own advisory on 4 November about an AI-assisted campaign it calls “CRAFTY FALCON“, targeting banks, non-banking finance companies, fintech firms and payment providers. According to CERT-In, the campaign uses AI-driven offensive tools to survey targets, operate at machine speed and exploit victims’ own payment and disbursement APIs to move money without authorisation. India’s cybercrime centre has separately told banks to treat the threat as immediate and continuing, and to report incidents within six hours.
The two advisories are separate — Pakistan’s comes from National CERT, India’s from CERT-In — but they describe the same shift: AI is lowering the skill and effort needed to run a serious financial cyberattack, and the tools to do it are now publicly available.
Pakistan’s exposure is already documented. Only three days earlier, National CERT told a National Assembly committee that Pakistan has recorded more than 1,000 cyberattacks so far in 2026, and that the agency runs on a staff of just 70 people, with about 70 per cent of its threat-monitoring work still done manually. A separate roundup counted roughly 760,000 Pakistan-linked login credentials in infostealer logs this year, more than half tied to government domains.
That combination — fast-moving AI-powered cyberattacks on one side, and thinly stretched defences on the other — is the real story behind the advisory. National CERT is not warning about a distant possibility. It is telling banks and infrastructure operators that the tools to attack them are already in criminals’ hands, and that the time to close the gaps is now.
Related Posts
TechnologyBinance Reopens Withdrawals for More Assets After $6.3 Billion Hack — HYPE, INJ, APT, NEAR and LTC Targeted by Next Week
TechnologySBP Core Banking Network Goes Live as Cisco Data Centre Switches On in Karachi
TechnologyJaecoo J5 EV Pakistan Price Announced — Ex-Factory Price, Variants, Bookings and Delivery
TechnologyAMD Q3 Earnings: Data Centre Revenue Soars 97% as AI Chip Demand Defies the Nasdaq Rout
TechnologyNasdaq Crashes 5.5% Into Correction as AI Stock Rout Wipes $3 Trillion — KSE-100 Falls Too
TechnologyGPT-6.2 Astra: OpenAI’s Next Model May Launch TodayMost Popular
How-ToPTA Tax Calculator 2026: Check Mobile Tax on Any Phone417 views
Pakistan NewsPIA Boeing 787 Lease Deal: What It Means for the Airline389 views
Canada JobsTech Jobs in Canada: Roles, Salaries, and Skills Needed387 views
SportsUEFA Champions League 2026-27: Format, Teams and Schedule384 views
TechnologyPM Shehbaz Sets November Deadline for Alibaba AI and Digitalisation Projects in Pakistan364 views
ShowbizWomen’s Fashion in Pakistan 2026: Trends, Brands and Style Guide360 views
