Hackers Used Claude and Grok to Automate Cyberattacks on More Than 400 Banks and Financial Firms

A cybercrime group used artificial intelligence (AI) agents to coordinate attacks against more than 400 banks, payment providers and other financial organizations across Latin America, according to a report from cybersecurity company Straiker.

The group, identified as CyberCartel, reportedly used AI models provided by Anthropic, xAI and Moonshot AI to plan and execute portions of its operations. Straiker said the targets spanned multiple countries but did not publish the names of the affected institutions.

Researchers described the platform, dubbed CARLIY0S, as an AI-driven framework designed to allow a small operator team to manage more targets and reduce time spent on manual tasks.

CARLIY0S connected multiple AI models with automation tools and shared data stores so different agents could analyze target information, recommend actions and help coordinate activity across the operation.

Straiker’s report documents an investigation of the group’s systems and files; it does not claim that every one of the more than 400 targets was successfully breached.

Investigators linked CARLIY0S to operators who appear to have used the handles Tr4nsHack Team and Hexagon Security Labs Mexico.

Straiker describes CARLIY0S as an attack framework rather than a single malware file. The system reportedly combined PentAGI—an automated security-testing framework—with custom scripts, AI model configurations and other tooling.

While PentAGI can be used for legitimate security testing, Straiker warns such automation can be repurposed for malicious activity.

Hackers Used Claude and Grok

The report explains that multiple Claude models were assigned specific roles within the workflow: some analyzed target data and proposed next steps, while another reviewed those proposals and issued a final decision.

Straiker says Grok models from xAI were used to help collect secrets into a database the group called FinancialSoft. Moonshot AI’s Kimi models were also employed, including as alternatives when other models refused to process certain requests.

Importantly, the models were embedded in a larger automated workflow, not simply used as one-off chatbots. Model outputs were connected to tools that could inspect web traffic, manage data and run automated tasks. Straiker observed that operators often framed requests as authorized testing or academic research to make malicious prompts appear legitimate to AI systems.

The findings add to other reporting about the use of Claude-based agents in cyberattacks, though those incidents are separate and rely on different evidence.

Straiker reports CARLIY0S used automated browser software and residential proxy services as part of its operations. The company describes attempts to exploit financial organizations’ web systems and to search for credentials and sensitive information after gaining access.

These conclusions come from Straiker’s review of the group’s files and infrastructure; the report does not publicly identify the affected organizations. Straiker says it removed or redacted sensitive information from the material it published.

The group’s collected data reportedly included email addresses, account numbers, passwords, API keys and other access details. Straiker counted 4,493 records in the FinancialSoft database snapshot it examined.

The report also notes credentials tied to payment services and financial infrastructure, including records linked to Mexico’s SPEI interbank payment system. The presence of such records increases the risk of fraud or further access, but does not by itself prove that each credential was successfully used.

Why the finding matters

The case illustrates how AI can help criminals scale established tactics—researching targets, using stolen credentials and coordinating technical tasks—by automating and organizing work across many targets.

It does not show that AI independently selected every target or executed every action without human involvement. Straiker’s analysis indicates humans, scripts, infrastructure and commercial AI models all worked together in the operation.

The danger lies in how those components are integrated and what access the combined system is allowed to use. Straiker also found the operators had fallback methods when a model refused a request, including local code that did not rely on any external model.

That means blocking a single provider credential may disrupt part of the operation but might not stop it entirely if the group can switch tools or rely on existing scripts.

Straiker says Anthropic revoked a credential linked to the activity, and xAI was notified and investigating the reported use of Grok.

For defenders, Straiker recommends protecting identity and payment systems, limiting the access granted to automated tools, and monitoring for unusual account or API activity. Financial institutions should review not only core banking systems but also connected services—support portals and payment interfaces can also hold sensitive data.

Security teams can study related reporting on AI agents and automated attack frameworks, while treating each investigation’s evidence and scope independently. The investigation warns of the speed and reach automation can add to cybercrime.

It is not evidence that AI has replaced human attackers; instead, AI appears to have helped CyberCartel coordinate activity across a wide set of targets. For banks and payment firms, robust access controls, careful monitoring and rapid credential revocation remain central defenses.

Indicators of compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (for example, using [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat-intelligence platforms such as MISP, VirusTotal or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI feeds with data from 16K SOCs.