Key points
- A multi-agent system called CARLIY0S coordinated attacks against more than 400 financial institutions and payment providers in Latin America.
- The operation combined commercial AI models including Anthropic’s Claude, xAI’s Grok and Moonshot AI’s Kimi with automation tools.
- Investigators found a database containing thousands of email addresses, account numbers and other access credentials from the campaign.
Security researchers have identified a sophisticated campaign targeting financial institutions across Latin America using artificial intelligence to automate attack processes. According to a report by GBHackers, cybercriminals deployed a multi-agent system named CARLIY0S to probe more than 400 banks and payment providers. The investigation, conducted by Straiker, reveals how commercial AI models were integrated into a coordinated offensive against the region's financial sector.
The CARLIY0S system was built around the PentAGI offensive-security framework and assigned specific tasks to different AI models. Claude agents were configured to analyze targets and synthesize decisions, while Grok-powered components gathered information for a database called FinancialSoft. Moonshot AI’s Kimi models also appeared within the workflow. Straiker notes that these findings came from artifacts left in the group’s working environment, providing insight into how AI was incorporated into this criminal operation.
Operational Tactics and Infrastructure
The report describes a shift from manual hacking scripts toward an orchestrated system designed to help a small group assess and pursue many targets simultaneously. The operators used AI prompts framed as authorized security testing, combined with automated browser activity and residential proxy services to mask their origins. Straiker cautions that some configuration entries do not prove the models were successfully invoked, but the infrastructure suggests a high level of automation.
Crucially, the group maintained a local code fallback when models refused requests, meaning a refusal did not necessarily stop the operation. This wider tool chain connected AI-generated analysis to browsers, traffic inspection, shared data and operator infrastructure. The risk lies not only in what a model can generate, but in how its output is connected to tools and real-world access.
Who Is Affected
The campaign targeted more than 400 organizations, though this figure refers to entities probed rather than confirmed breaches. The group, tracked by Straiker as AiPT-67, operated under the alias Tr4nsHack Team and Hexagon Security Labs Mexico. Straiker links this activity to CyberCartel, a financially focused threat actor active since 2012. Post-compromise objectives included searching for credentials, mapping internal systems and collecting sensitive financial and identity data.
A snapshot of the FinancialSoft database from 24 September 2026 reportedly contained 4,493 records. This included 2,911 email addresses and 903 account numbers, along with passwords, API keys and other access material. These details indicate that the attackers compiled significant amounts of sensitive data during the campaign.
Our take on the response
The source material does not confirm whether a patch or fix exists for the vulnerabilities exploited in this campaign. Organizations in Latin America should verify if they were among the 400 targets. Security teams should review logs for unusual browser automation or proxy usage. The use of AI to automate reconnaissance suggests that traditional manual detection methods may be less effective. Institutions should assume that their external-facing systems were probed and monitor for credential misuse.
What affected people can do
Individuals and teams should monitor account statements for unauthorized transactions and review recent login activity for unfamiliar devices. Check whether any API keys or service accounts were exposed in public repositories or leaked databases. Be vigilant for phishing emails that reference recent security incidents or claim to be from your bank. Change passwords for financial accounts immediately if you suspect exposure. Teams usually recommend enabling multi-factor authentication to add a layer of protection against stolen credentials.
Background: Threat actors
Threat actors in cybersecurity are individuals or groups who intentionally compromise systems to steal data, disrupt operations or extort money. They range from lone hackers to state-sponsored teams. Defending against them requires analysing behaviour, not just blocking known malicious files or IP addresses.
Read the full guide: Threat Actors in Cybersecurity: Tactics, Profiles and Detection Strategies
What to do and how to stay safe: Claude
- Review external-facing infrastructure for signs of automated scanning or unusual traffic patterns associated with residential proxies.
- Rotate any API keys or service account credentials that may have been exposed in the FinancialSoft database.
- Monitor for phishing attempts that leverage the names of the targeted institutions to trick employees into revealing credentials.
- Implement stricter controls on AI tool usage to prevent internal models from being misused for malicious analysis.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which AI models were used in the CARLIY0S attack system?
The system used Anthropic’s Claude, xAI’s Grok and Moonshot AI’s Kimi alongside automation tools.
How many organizations were targeted by this campaign?
More than 400 financial institutions and payment providers across Latin America were targeted.
What data was found in the FinancialSoft database?
The database contained email addresses, account numbers, passwords, API keys and other access material.