Hackers Use Claude and GPT-Powered Tools to Help Breach Government and Financial Networks
Unit 42 links two Latin America campaigns where operators used Claude and GPT-4.1 during intrusions against government and financial targets.
74
Threat actor
CL-CRI-1163
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenSep 3, 2026
- Last mentionedSep 10, 2026
Timeline
5 articles · newest firstHackers Use LLMs to Generate Exploit Scripts and Automate Post-Exploitation Across Latin America
Unit 42 says Latin American attackers used LLMs to automate post-exploitation in campaigns hitting Mexican government, water utilities, and Brazilian financial firms.
58
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.
75
Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems
Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.
82
Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America
Unit 42 documents two AI-assisted intrusion campaigns against Latin American government, utility, and financial organizations using LLM-orchestrated tooling.
72
Appears with
- Palo Alto Networksvendor · 4
- Claudeai model · 3
- SHADOW-AETHER-064threat actor · 3
- CL-CRI-1131threat actor · 3
- GPT-4.1ai model · 3
- NextChatproduct · 3
- CrowdStrikevendor · 2
- Google Threat Intelligence Grouporganization · 2
- SockTzproduct · 2
- Plump Spiderthreat actor · 2
- Mandiantorganization · 2
- Trend Microvendor · 2
- Breeze Cometthreat actor · 2
- Unit 42vendor · 2
- SHADOW-AETHER-040threat actor · 1
- Gambitorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.