A security report points to a group that allegedly used Claude, Grok and Kimi to attack banks in Latin America
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Straiker attributes to CyberCartel a campaign using several AI models that went after more than 400 financial sector targets in Latin America. CARLIY0S combined Claude, Grok and Kimi, and one of the group's databases held 4,493 stolen records. Anthropic withdrew the credential the group used with Claude and xAI was examining what happened, according to the firm.
Cybersecurity firm Straiker on Wednesday, October 21, published an investigation by its STAR Labs team into CyberCartel, a group that, according to the report, directed attacks within a few months against more than 400 financial targets in Latin America, including banks and payment providers. In that campaign it operated as Tr4nsHack Team, with the front company Hexagon Security Labs Mexico, and its members include operators already known from CyberCartel.
According to Straiker, the group used CARLIY0S, a decentralized attack system that integrated several commercial AI models: Claude, from Anthropic, in its Sonnet and Opus versions; Grok, from xAI; and Kimi. The system's own configuration, quoted in the report, relied on sub-agents through Anthropic's API.
Straiker's researchers also accessed a copy of FinancialSoft, the group's stolen-credential database, with 4,493 records. Most of them are identity and financial account data, headed by 2,911 email addresses and 903 account numbers.
According to Straiker, Anthropic later revoked the compromised credential the group used to reach Claude, and xAI, which was notified, was examining the activity. All of these figures come from Straiker's own report.
Why it matters · analysis and opinion
What stands out is not that a criminal group uses AI, but that it splits the work among several commercial models inside a single system. It should be read with caution: all the data come from the report of a single cybersecurity firm, Straiker, and the victims are unnamed. Even so, the lesson for banks and payment companies in the region does not depend on who is behind it: what fuels these attacks are stolen credentials and exposed accounts. Checking which access keys are still active, rotating them often and monitoring access to accounts are measures that make sense in any case. For model providers, the case shows how much depends on detecting and revoking a compromised credential in time.
Official source: Straiker · Written with the help of AI: how we make the news
