Cybercriminals used a multi-agent system called CARLIY0S to coordinate attacks against more than 400 financial institutions and payment providers across Latin America.
The system combined commercial AI models including Anthropic’s Claude, xAI’s Grok and Moonshot AI’s Kimi with automation and shared operational infrastructure.
Straiker says its findings came from artifacts in the group’s working environment, offering an unusual view of how AI was incorporated into a criminal operation.
The report describes a shift from manual hacking and scripts toward an orchestrated system intended to help a small group assess and pursue many targets.
The figure of more than 400 refers to organizations targeted; it does not establish that every organization was breached.
CARLIY0S was not a single AI model or malware sample. Built around the PentAGI offensive-security framework, it assigned models different tasks.
Claude agents were configured to analyze targets, assess possible approaches and synthesize decisions; Grok-powered “miners” gathered information for a database called FinancialSoft; and Kimi models appeared in the system’s workflow.
The report says the operators also had a local code fallback when models refused requests, meaning a refusal did not necessarily stop the operation.
Straiker cautions that some model configuration entries do not prove those models were successfully invoked.
The investigation describes a wider tool chain connecting AI-generated analysis to browsers, traffic inspection, shared data and operator infrastructure.
Straiker says the group used AI prompts framed as authorized security testing, automated browser activity and residential proxy services.
Its reported post-compromise objectives included searching for credentials, mapping internal systems and collecting sensitive financial and identity data.
These details matter because the risk lies not only in what a model can generate, but in how its output is connected to tools and real-world access.
The group, tracked by Straiker as AiPT-67, operated as Tr4nsHack Team under the name Hexagon Security Labs Mexico. Straiker links it to CyberCartel, a financially focused threat actor it says has been active since 2012.
Claude and Grok Exploited
A September 24, 2026 snapshot of FinancialSoft reportedly contained 4,493 records, including 2,911 email addresses and 903 account numbers, along with passwords, API keys access and other access material.
Straiker also reported credentials associated with payment infrastructure and Mexico’s SPEI interbank payment system. The firm says victim organizations were anonymized and live credentials and exploit material were redacted.
These are findings reported by Straiker, not an independently verified tally of successful intrusions or financial losses.
The disclosure also prompted action by AI providers. Straiker says Anthropic revoked the compromised credential used to access Claude, cutting off that route, while xAI was notified and was investigating activity associated with the Grok miners.
That response is significant, but it also illustrates a limitation of relying on one provider to disrupt a multi-model operation: attackers may switch models, use local code or continue with conventional tools.
For defenders, the central lesson is operational. AI can compress reconnaissance, analysis and coordination, but it does not eliminate the need for stolen credentials, vulnerable services or poor access controls.
Banks and payment firms should prioritize credential and API-key rotation, least-privilege access, protection of identity and payment systems, and monitoring that connects suspicious activity across accounts, endpoints and applications.
Security teams should also maintain an inventory of AI agents and the tools and data they can reach, and test whether those agents can be misused or made to act beyond their permissions.
CARLIY0S points to a change in how cybercrime can be organized: AI is being used not merely for isolated tasks, but as part of a coordinated attack workflow.
The human operators remain central; the system’s significance is that it may help them work faster and at greater scale.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
