CyberCartel used AI agents against 400-plus financial targets, Straiker says

CyberCartel assigned commercial AI models roles in choosing targets and coordinating attacks against more than 400 Latin American financial targets over several months, according to cybersecurity company Straiker. Its October 21 investigation describes CARLIY0S, a system that put Claude, Grok and Kimi to work across different stages of the operation—not just as coding assistants.

Straiker’s evidence comes from inside the group’s working environment: scripts, model configurations, shared records, infrastructure and a database of collected secrets. That vantage point lets the company describe how the pieces connected, rather than relying only on requests seen by an AI provider. Straiker attributes the operation to CyberCartel members working as Tr4nsHack Team under the name Hexagon Security Labs Mexico.

Models debated; an arbiter decided

CARLIY0S was built on PentAGI, an open-source platform for automated security testing. According to Straiker, the group used commercial models at different stages, separating decisions about an attack from the tools that carried it out. The system’s commander was Claude running inside Cursor, a coding environment, and calling a command-line tool.

Four Claude-based roles handled execution, analysis, alternative approaches and final arbitration. They evaluated attack options and debated targets, with a designated arbiter returning one decision. The arrangement matters to understanding Straiker’s finding: the models were configured to contribute to operational choices, rather than simply answer isolated questions from a human hacker.

The operation also had shared memory. Two operator machines could read and write the same knowledge graph—a connected store of findings—so a target discovered on one machine became visible on the other. This gave separate workers access to accumulated discoveries instead of leaving each machine with its own disconnected record.

Straiker says the attackers bypassed model safeguards by presenting requests as authorized security testing or academic hacking exercises. That claimed permission was false, according to the investigation. The distinction is central: a security-testing framework supplied the structure, while the operators supplied a misleading explanation for what the models were being asked to do.

4,493Database records

Straiker counted 4,493 records in the FinancialSoft snapshot.

2,911Email addresses

The inventory included 2,911 email addresses.

903Account numbers

The inventory also contained 903 financial account numbers.

Stolen secrets could provide reusable access

On September 24, 2026, Straiker accessed a snapshot of FinancialSoft, the group’s stolen-credential database. It says the records were collected using five tools it calls “Grok miners.” Beyond identity and account information, the inventory contained credentials and backdoors that could support further access to financial systems, data stores and payment infrastructure.

• Direct logins: Straiker lists 67 readable passwords, 51 portal logins and 43 database connection strings containing usernames and passwords.
• Payment access: One fintech victim accounted for 11 API keys, used for software access, and 32 cryptographic keys. Straiker says the exposed material could enable abuse of SPEI, Mexico’s interbank payment system.
• Persistent entry: Six explicit backdoors included master-password bypasses and shared administrator accounts. Straiker says these could give the group a way back into systems after cleanup.

The scale needs careful reading: Straiker describes more than 400 financial targets, not 400 named, individually documented breaches. It anonymized affected banks, financial institutions and payment gateways for responsible disclosure. The company also says it redacted or sanitized active keys, live credential dumps and proof-of-concept exploits in the published material.

Anthropic cut off the Claude credential

Straiker’s provider coordination began before publication. It shared relevant indicators with affected AI providers, and Anthropic revoked the compromised credential used to reach Claude, cutting off that access. Straiker said xAI had been notified and was investigating activity associated with the five Grok miners. Those are different response stages: the report describes a completed credential revocation for Claude and an investigation for Grok.