Islamabad: Pakistan’s National Cyber Emergency Response Team has cautioned banks, financial institutions and operators of critical services against emerging cyber threats driven by artificial intelligence, warning that such attacks could show customers false account balances, disrupt online banking and target payment systems.
In its national cyber advisory NCA 26.051126, National CERT said cybercriminals may use AI-based tools, automated bots and other advanced methods to find security weaknesses, steal login credentials and launch coordinated attacks at greater speed and scale.
The advisory makes clear that the AI threat is not limited to a single form of hacking. It includes automated attempts to break into accounts, misuse of stolen login details, abnormal requests sent through banking applications, and possible manipulation of customer-facing screens. In one key risk highlighted by CERT, customers may be shown incorrect account balances on digital banking platforms even if the actual money in their accounts has not changed. Such a situation could create panic and confusion among users.
CERT said attackers could also target core banking systems, digital banking platforms, application programming interfaces, payment gateways and customer service systems. These attacks may interrupt online services, attempt unauthorised access to customer accounts or seek entry into payment systems.
Banks have been advised to monitor warning signs such as a sudden rise in automated login attempts, repeated password failures, attempts to use stolen credentials and unusual activity through banking applications. Other indicators include unexpected changes in application settings, unusual transaction patterns, differences between a bank’s main records and balances displayed to customers, and unauthorised access to payment systems.
The advisory urged banks to review the security of core banking systems, digital apps, payment gateways and services provided by third-party companies. It also recommended multi-factor authentication, stronger protection against automated login attacks, strict access control for sensitive systems and regular comparison of customer-facing balances with actual banking records.
National CERT also warned that AI-powered and automated cyberattacks could affect critical infrastructure, including oil and gas facilities, refineries, pipelines, electricity generation and distribution networks, water utilities, manufacturing plants and transport systems.
According to the advisory, weaknesses in internet-connected devices, industrial control systems and remote access services used by outside service providers could allow attackers to interfere with essential operations. A successful attack on such systems may not remain limited to computers and could affect physical operations.
CERT identified suspicious changes in pipeline, refinery and power network settings, as well as abnormal changes in pressure, temperature, cooling and other industrial controls, as possible warning signs. Organisations were also told to watch for unauthorised access to industrial control systems and supervisory control and data acquisition systems, commonly known as ICS and SCADA.
Unexpected remote access sessions and unusual changes in Internet of Things and operational technology devices should also be treated as suspicious, the advisory said.
The advisory referred to recent cyber incidents reported at European supermarkets involving refrigeration and freezer systems, noting that attacks on connected operational systems can create physical and business disruption. However, it clarified that the use of artificial intelligence in those incidents had not been confirmed.
To reduce risks, CERT asked organisations to identify devices and industrial systems directly exposed to the internet and limit such exposure, particularly for remote maintenance links used by third-party service providers. It also recommended separating office computer networks from industrial control networks to prevent an attack on one system from easily spreading to another.
Organisations were further advised to continuously monitor access to operational systems, install security updates, maintain backups, improve incident response plans and strengthen business continuity arrangements. They were also asked to maintain security records and report suspected cyber incidents through relevant national cybersecurity channels.
The advisory was issued by the National Cyber Emergency Response Team, operating under the Government of Pakistan, from the Pak Secretariat in Islamabad. It said organisations may consult its official website for further cybersecurity advisories.
The advisory describes potential threats and warning signs. It does not report any confirmed cyberattack on a Pakistani bank or critical infrastructure facility.
