Pakistan’s National CERT Warns Banks of AI-Powered Cyberattacks Targeting Accounts and Power Grids

Pakistan’s National Cyber Emergency Response Team (National CERT) has warned banks, financial institutions and critical infrastructure operators that AI-powered cyberattacks are now a serious and immediate threat to the country’s digital economy.

In a new advisory issued on 6 November 2026, titled “Emerging AI-Enabled Cyber Threats Targeting Financial Institutions and OT/Critical Infrastructure”, National CERT said cybercriminals are increasingly using artificial intelligence, automated bots, botnets and agentic tools to find weaknesses in computer systems, steal login credentials and launch coordinated attacks.

The warning matters for everyone who uses online banking, mobile payments or digital services in Pakistan. The systems the advisory talks about are the ones millions of people rely on every day: the apps they use to transfer money, the payment gateways behind online shopping, and the power and water networks that keep homes and businesses running.

What the warning says

National CERT is Pakistan’s national team for responding to cyber emergencies. When it issues an advisory, it is telling organisations across the country that a threat is real, that it is growing, and that they need to act before an attack happens — not after.

This advisory focuses on a clear change in how cyberattacks work. In the past, hacking was often slow, manual work. An attacker had to probe a system, guess passwords and work through defences step by step. Artificial intelligence has changed that. AI tools can now scan thousands of systems at once, test stolen usernames and passwords far faster than any human, and adapt when a login attempt fails. They can try new combinations without stopping, and they can run many attacks at the same time.

The advisory also points to “agentic tools” — software agents that can carry out multi-step tasks with little human supervision. In simple terms, these are AI programs that can be given a goal, such as breaking into a system, and then work through the steps on their own. That lowers the skill and effort needed to run a serious cyberattack, and it means attacks can now move at machine speed.

Banks are the first target

The warning is most detailed about the threat to banks and financial institutions. National CERT said banks could face attacks on four main areas:

• Core banking systems — the central systems that hold account records and process transactions.
• Digital platforms — the mobile apps and websites customers use every day.
• Payment gateways — the systems that move money when people pay bills, shop online or transfer funds.
• Application programming interfaces (APIs) — the connectors that let apps and services talk to each other, moving data between banks, fintech apps and merchants.

One of the most immediate risks is automated login attempts. AI tools can test large lists of stolen usernames and passwords against banking apps at great speed. When an attempt succeeds, criminals get direct access to an account. When thousands of attempts fail, they can still overwhelm a system and lock genuine customers out of their own money.

The advisory also warns that attackers could tamper with the account balances customers see on screen. Even if no money is actually stolen, a manipulated display can convince people their savings have vanished. That can set off panic withdrawals and a flood of complaints while the bank is still under attack — making a bad situation worse.

National CERT’s advice to financial institutions is practical: enforce multi-factor authentication (MFA) so that a password alone is not enough to log in, tighten access controls, monitor systems continuously, and reconcile transactions independently, so that a tampered balance is caught by a second check.

Power, water and transport are also in the firing line

The warning does not stop at banking. National CERT also highlighted risks to oil and gas facilities, power networks, water utilities, manufacturing plants and transport systems — the operational technology, or OT, that keeps the country’s physical infrastructure running.

These systems are vulnerable in different ways from banks. Industrial control systems, connected devices and third-party remote access all create entry points, and many of these systems were designed long before cybersecurity was a consideration. An AI-powered attack that reaches them does not need to steal money: disrupting a power grid, a water supply or a transport network causes damage directly, and the consequences fall on the public rather than on a single company.

Critical infrastructure operators were urged to secure their industrial systems, restrict direct exposure to the internet, keep their IT networks separated from their operational technology networks, and strengthen backups so that a successful attack does not become a lasting outage.

Organisations have also been advised to review their preparedness against AI-driven cyberattacks specifically, to maintain proper security logs, and to report suspected incidents through the relevant national cybersecurity channels. The message is that preparation cannot wait for an incident: by the time an AI-driven attack is visible, it is already moving at machine speed.

A regional pattern is emerging

The warning lands in a week when the same threat has surfaced across the border. India’s Computer Emergency Response Team, CERT-In, issued its own advisory on 4 November about an AI-assisted campaign it calls “CRAFTY FALCON”, targeting banks, non-banking finance companies, fintech firms and payment providers.

According to CERT-In, the campaign uses AI-driven offensive tools to survey targets, operate at machine speed and exploit victims’ own payment and disbursement APIs to move money without authorisation. India’s cybercrime centre has separately told banks to treat the threat as immediate and continuing, and to report incidents within six hours.

The two advisories are separate — Pakistan’s comes from National CERT, India’s from CERT-In — but they describe the same shift: AI is lowering the skill and effort needed to run a serious financial cyberattack, and the tools to do it are now publicly available.

Why Pakistan is exposed

Pakistan’s exposure is already documented. Only three days before the advisory, National CERT told a National Assembly committee that Pakistan has recorded more than 1,000 cyberattacks so far in 2026, and that the agency runs on a staff of just 70 people, with about 70 per cent of its threat-monitoring work still done manually.

That combination — fast-moving AI-powered attacks on one side, and thinly stretched defences on the other — is the real story behind the advisory. National CERT is not warning about a distant possibility. It is telling banks and infrastructure operators that the tools to attack them are already in criminals’ hands, and that the time to close the gaps is now.

The warning also fits a wider pattern. Earlier this year, in March 2026, National CERT issued a separate advisory warning that hostile actors could exploit supply chains to target critical national infrastructure, including power, banking and defence systems. The November advisory shows the threat has moved on: it is no longer only about supply chains or state-sponsored espionage, but about AI-powered crime that any well-equipped criminal group can now attempt.

What this means for ordinary account holders

For ordinary people, the advisory does not mean they should stop using online banking. It means the systems they use are being targeted more cleverly than before, and that a few simple habits make a real difference.

Use multi-factor authentication

Turn on multi-factor authentication on every banking and payment app that offers it. With MFA, a stolen password alone is not enough: the attacker also needs a code from your phone or an approval on your device. This is the single most effective step the advisory recommends.

Be suspicious of login problems

If your banking app suddenly locks you out, or shows a balance that looks wrong, do not panic — but do not ignore it either. Contact your bank through its official helpline or branch, not through a phone number or link in a message you received. A manipulated balance display is one of the tactics the advisory specifically warns about.

Keep passwords unique

Never reuse the same password for your bank and other websites. AI tools test stolen passwords from one website against banking apps. A unique password for each important account stops that trick from working.

Keep apps updated

Banks fix security weaknesses through app updates. Installing updates promptly means you get those fixes as soon as they are available.

Report anything strange

If you notice a transaction you did not make, a login alert you do not recognise, or a message pretending to be from your bank, report it to your bank and through the proper national channels. Early reports help National CERT and banks spot an attack while it is still small.

What happens next

The advisory is a warning, not a report of a single attack. No bank or infrastructure operator has been named as a victim in the advisory itself, and National CERT has not said that a major attack has already happened. The point of the warning is prevention: banks and operators have been told what to check, what to strengthen and what to watch for.

What to watch for in the coming weeks is whether banks publicly confirm they have tightened their defences, whether National CERT issues follow-up guidance, and whether any incidents are reported. If AI-powered attacks are already being attempted at scale, the first public signs are likely to be brief disruptions to online banking, unusual login alerts, or warnings from individual banks to their customers.

For Pakistan’s digital economy, the stakes are high. Online banking, mobile payments and digital services have grown quickly, and millions of people now depend on them every day. The advisory is a reminder that as these services grow, so does the need to protect them — and that the attackers are now using the same technology, artificial intelligence, that is transforming everything else.

Frequently asked questions

What is National CERT?
National CERT is Pakistan’s National Cyber Emergency Response Team. It monitors cyber threats, warns organisations about new dangers, and coordinates the response when serious cyber incidents happen.

What are AI-powered cyberattacks?
They are cyberattacks that use artificial intelligence to work faster and at larger scale than traditional hacking. AI can scan systems for weaknesses, test stolen passwords automatically, and run many attacks at once with little human input.

What is an agentic tool?
An agentic tool is a software agent that can carry out multi-step tasks with little human supervision. In a cyberattack, it can be given a goal and then work through the steps — such as finding a weakness and exploiting it — on its own.

What is operational technology (OT)?
Operational technology is the hardware and software that controls physical equipment: power plants, water systems, factory machinery and transport networks. It is different from normal IT systems, which handle data and communication.

Has a bank in Pakistan been hacked?
The advisory does not name any bank as a victim, and it does not report a specific successful attack. It is a warning about a growing threat, based on the techniques attackers are now using.

What should I do if my bank balance looks wrong?
Do not panic, and do not share your password or OTP with anyone. Contact your bank through its official helpline or by visiting a branch, and ask them to check your account. A manipulated balance display is one of the tactics the advisory warns about.

Is this threat only in Pakistan?
No. India’s CERT-In issued a similar warning on 4 November 2026 about an AI-assisted campaign targeting banks and payment providers. AI-powered attacks on financial systems are a global and regional trend.

Conclusion

National CERT’s warning is clear: AI-powered cyberattacks are no longer a future problem for Pakistan’s banks and critical infrastructure — they are a present one. Criminals are using artificial intelligence, automated bots and agentic tools to hunt for weaknesses, steal credentials and strike in coordinated waves, and the targets include the core banking systems, payment gateways and power networks that millions of people depend on.

The defences the advisory recommends are practical and well known: multi-factor authentication, stronger access controls, continuous monitoring, separated networks and solid backups. The question now is how quickly banks and infrastructure operators put them in place. For ordinary account holders, the advice is simpler still: turn on multi-factor authentication, keep passwords unique, keep apps updated, and report anything suspicious.

The advisory ends with a message that applies to everyone involved — preparation cannot wait for an incident, because by the time an AI-driven attack is visible, it is already moving at machine speed.

Sources

• TechJuice — “National CERT Warns Banks of AI-Powered Cyberattacks” (6 November 2026): https://www.techjuice.pk/national-cert-warns-banks-of-ai-powered-cyberattacks/
• UrduPro — “National CERT Warns Banks of AI-Powered Cyberattacks” (6 November 2026): https://urdupro.info/national-cert-ai-cyberattacks-banks-pakistan/
• NationPulse — “National CERT Warns Banks of AI-Powered Cyberattacks” (6 November 2026): https://nationpulse.uk/national-cert-warns-banks-of-ai-powered-cyberattacks

This article is for general information and education only. It is not legal or financial advice.