CyberCartel used Claude and Grok against 400-plus financial firms
Original title: Hackers Used Claude and Grok to Automate Cyberattacks on Over 400 Banks and Financial Firms
Straiker reviewed the group’s CARLIY0S system and a snapshot of 4,493 records, without confirming every target was breached.
Straiker says CyberCartel, also linked to the Tr4nsHack Team and Hexagon Security Labs Mexico, used an AI-driven framework called CARLIY0S against more than 400 banks, payment providers, and other financial organizations in Latin America. Claude, Grok, and Moonshot AI’s Kimi models were assigned roles inside workflows that also used PentAGI, browser automation, and residential proxies. A FinancialSoft snapshot held 4,493 records, including emails, account numbers, passwords, and API keys, some tied to Mexico’s SPEI system. Anthropic revoked a related credential; xAI was notified and was investigating.
Unconfirmed: Straiker did not name the institutions and did not confirm that every stored credential was used.
- Straiker says the work was an investigation of the group’s systems, not proof every target was breached.
- Kimi models were used as a fallback when other models refused requests.
- Operators framed requests as authorized testing or academic work.
- Straiker lists IP 157.180.98.220 as a Hexagon central server; no file hashes were published.
Impact: Collected emails, account numbers, passwords, and API keys
- 1.Watch for unusual account and API activity on payment and identity systems.
- 2.Limit access granted to automated tools and connected support portals.
- 3.Review the reported IP 157.180.98.220 in threat-intelligence platforms.
- Vendors
- AnthropicxAIMoonshot AI
- Threat actors
- CyberCartelTr4nsHack Team
- Malware
- CARLIY0S
- Organizations
- StraikerHexagon Security Labs Mexico
- Countries
- Mexico
From the original article
4 min read at cybersecuritynews.com
A cybercrime group used artificial intelligence (AI) agents to coordinate attacks against more than 400 banks, payment providers and other financial organizations across Latin America, according to a report by cybersecurity company Straiker. The group, known as CyberCartel, reportedly used AI models from Anthropic, xAI and Moonshot AI to help plan and carry out parts […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.