Criminals used Claude, Grok and Kimi against Latin American finance targets
Original title: Cybercriminals Used Claude and Grok to Launch Automated Attacks Against Banks
Straiker says more than 400 organizations were targeted, not that each one was breached.
Straiker reports that a group it tracks as AiPT-67, also called Tr4nsHack Team and Hexagon Security Labs Mexico, used a multi-agent system named CARLIY0S. Claude analyzed targets, Grok-powered miners filled a FinancialSoft database, and Kimi appeared in the workflow, with local code when models refused. A reported snapshot included credentials tied to payment infrastructure and Mexico’s SPEI system. Anthropic revoked the Claude credential; xAI was notified and was investigating.
Unconfirmed: Straiker’s account is not independently verified, and configuration entries do not prove models were successfully invoked.
- CARLIY0S was built around the PentAGI offensive-security framework.
- A September 24, 2026 FinancialSoft snapshot held 4,493 records.
- Those records included 2,911 email addresses and 903 account numbers.
- Anthropic revoked the compromised credential used to access Claude.
- Straiker links the operators to CyberCartel, which it says has been active since 2012.
Impact: Credentials, API keys, and financial and identity data sought
- 1.Rotate credentials and API keys used by banks and payment firms.
- 2.Inventory AI agents and the tools and data they can reach.
- Vendors
- AnthropicxAIMoonshot AI
- Threat actors
- AiPT-67Tr4nsHack TeamCyberCartel
- Organizations
- Straiker
- Countries
- Mexico
From the original article
3 min read at gbhackers.com
Cybercriminals used a multi-agent system called CARLIY0S to coordinate attacks against more than 400 financial institutions and payment providers across Latin America. The system combined commercial AI models including Anthropic’s Claude, xAI’s Grok and Moonshot AI’s Kimi with automation and shared operational infrastructure. Straiker says its findings came from artifacts in the group’s working environment, […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.