Pakistan’s National CERT has warned banks, payment companies and the operators of power, water, oil and gas systems that attackers are starting to use AI tools and automated bots to find weak spots and break in faster. One scenario in the warning touches ordinary account holders: someone tampering with the balance a banking app displays, even though the money itself has not moved.
The advisory, numbered NCA-26.051126, says a wrong figure on screen could cause customers to panic. It does not describe an attack that has already happened at a Pakistani bank or utility.
The advisory expects banks to be hit where it hurts most: the core system, the APIs behind mobile banking, payment rails and the apps customers open every day. The signs it tells them to watch for are a jump in automated login attempts, repeated failed sign-ins, credential stuffing, odd API requests, changed app configurations, and any gap between core banking records and the balance a customer’s app shows.
Its fixes are multi-factor authentication, protection against automated logins, tighter control of privileged accounts, integrity checks between customer-facing apps and core records, and independent reconciliation of transactions.
The second group is physical infrastructure, from refineries and pipelines to water plants, power grids, factories and transport. Contractors with remote access, internet-connected IoT devices, flawed industrial control systems and poorly secured remote links are the entry points National CERT lists. Operators should look for unexpected changes to refinery, pipeline or grid parameters, shifts in pressure, temperature or cooling settings, and remote sessions nobody expected.
The advice there is to find which IoT and operational technology assets face the internet, limit remote access including maintenance links used by outside contractors, keep IT and operational networks separate, keep applying security updates and keep manual backup procedures ready.
As an example of physical damage from a cyberattack, the advisory cites recent incidents at European supermarkets that hit refrigeration and freezer systems. It adds that AI involvement in those incidents has not been confirmed.
The warning follows the 1,000-plus attacks National CERT has counted in Pakistan this year. All organisations are asked to check how ready they are for bot-driven AI attacks, strengthen incident response and business continuity plans, keep security logs, and report suspected incidents through the national cybersecurity channel.
