The phrase "machine speed" used to describe network latency or algorithmic trading. Now India's Computer Emergency Response Team is using it to characterize something more unsettling: the velocity at which a sophisticated threat actor is deploying AI-generated attack vectors against cryptocurrency exchanges and traditional financial institutions.

CERT-In's advisory, circulated to financial sector entities this week, describes an ongoing campaign that leverages large language models to generate convincing spear-phishing emails, automate vulnerability scanning, and rapidly iterate on social engineering scripts. The attacks are not merely faster—they are adaptive, with the threat actor apparently using AI to analyze failed intrusion attempts and generate modified approaches within hours rather than days.

The automation advantage

Traditional cyberattacks require human operators to craft phishing lures, research targets, and manually probe for weaknesses. The campaign CERT-In describes collapses that timeline dramatically. Security researchers familiar with the advisory say the attackers appear to be using commercially available LLMs—likely accessed through compromised API keys or jurisdictions with lax enforcement—to handle tasks that previously required teams of specialists.

The implications extend beyond India. Cryptocurrency exchanges globally have reported a surge in sophisticated social engineering attempts over the past quarter, with several noting that the linguistic quality and contextual awareness of phishing attempts has improved markedly. One exchange security officer, speaking on condition of anonymity, described receiving fake customer support tickets that referenced real transaction histories and used natural language indistinguishable from legitimate users.

The attribution puzzle

CERT-In's advisory stops short of naming a specific nation-state, though the targeting pattern—exchanges, payment processors, and banking APIs—suggests financial motivation rather than pure espionage. The use of AI tools complicates attribution further; the same LLM-generated content could theoretically be produced by actors anywhere with sufficient resources and motivation.

What is clear is that the defensive playbook has not kept pace. Most financial institutions still rely on pattern-matching and signature-based detection systems designed for an era when attackers moved at human speed. AI-generated attacks can mutate faster than rule-based systems can adapt, creating a structural advantage for offense.

Our take

The cybersecurity industry has spent years warning that AI would eventually supercharge attackers. India's advisory suggests that moment has arrived, not as a dramatic zero-day catastrophe but as a quiet acceleration in the tempo of ordinary attacks. The exchanges and banks that survive this phase will be those that deploy AI defensively—fighting machine speed with machine speed. Everyone else is bringing a rulebook to an algorithm fight.