Hackers use Claude and Grok to automate attacks on 400+ banks

The CARLIY0S framework

A cybercrime group known as CyberCartel has been identified using a sophisticated AI-driven attack framework to target financial institutions. According to a report by Straiker, the group used a system called CARLIY0S to coordinate attacks against more than 400 banks and payment providers across Latin America.

Rather than using a single piece of malware, CARLIY0S functioned as a coordinated workflow that connected various AI models with specialized software. This setup allowed a small team of human operators to manage a massive number of targets simultaneously by automating repetitive manual tasks.

The framework was designed to share data between different agents to review target information and suggest specific actions. By linking these models to tools that could inspect web traffic and manage data, the group created a pipeline for automated cyberattacks.

Multi-model AI integration

The attackers did not rely on a single AI provider, instead pulling from Anthropic, xAI, and Moonshot AI to perform different roles. For example, Claude models were assigned specific tasks where some analyzed target data to propose next steps while others reviewed those suggestions to make final decisions.

The group also utilized Grok models to assist in collecting secrets into a database they named FinancialSoft. When other models refused to perform certain tasks due to safety restrictions, the group used Moonshot AI’s Kimi models as a fallback to ensure the operation continued without interruption.

To bypass the safety guardrails of these commercial models, the operators framed their requests as authorized security testing or academic research. This tactic was intended to make their harmful instructions appear legitimate to the AI systems, allowing them to extract more information than they might otherwise be permitted to get.

Data theft and infrastructure

The investigation into the group's systems revealed that they successfully gathered a significant amount of sensitive information. Straiker identified a snapshot of the FinancialSoft database containing 4,493 records, which included email addresses, account numbers, passwords, and API keys.

The group also targeted infrastructure related to payment services, including Mexico’s SPEI interbank payment system. While the report does not confirm that every single credential was successfully used, the presence of these records creates a high risk of future fraud or unauthorized access.

To hide their tracks and reach their targets, the operators used residential proxy services and automated browser software. They specifically looked for ways to exploit web systems to find credentials and other sensitive data once they gained initial access to a network.

Defense and future risks

This case highlights a shift toward AI-assisted attack frameworks where human operators, scripts, and commercial models work in tandem. It shows that the primary risk comes from how these different components are connected and the level of access granted to the automated tools.

Security experts suggest that defenders must focus on protecting identity and payment systems while limiting the access granted to automated tools. Financial firms are encouraged to review all connected services, as support portals and payment interfaces often hold sensitive data that can be exploited.

While providers like Anthropic and xAI have been notified and are investigating the activity, the group maintains fallback methods. If one AI provider blocks an account, the group can switch to local code or other models, making it difficult to stop the operation by targeting a single service.

Identifying the threat actors

Researchers from Straiker identified the CARLIY0S system and linked it to a specific group of operators. These individuals were known to work as the Tr4nsHack Team and operated under the name Hexagon Security Labs Mexico during these activities.

While the report confirms that the targets spanned several different countries, Straiker did not publicly name the specific financial institutions involved. The investigation focused on the group's internal files and systems rather than confirming a successful breach for every single one of the 400+ targets.

Workflow and threat intelligence

The way these models were integrated is significant because they were embedded into a larger, automated workflow rather than being used as simple chatbots. This allowed the group to connect model outputs directly to tools that could manage data and inspect web traffic for specific tasks.

Security teams can use the indicators of compromise provided in the full report to update their defenses. These indicators are intentionally defanged to prevent accidental resolution and should only be re-fanged within controlled threat intelligence platforms like MISP, VirusTotal, or a SIEM.