AI Tools Claude, Grok Used in Automated Attacks on 400+ Financial Firms

Key Takeaways

• A cybercrime group, CyberCartel (also known as Tr4nsHack Team/Hexagon Security Labs Mexico), leveraged AI models from Anthropic (Claude), xAI (Grok), and Moonshot AI (Kimi) to automate attacks against over 400 financial institutions in Latin America.
• The attackers utilized a sophisticated AI-driven attack framework named CARLIY0S, integrating multiple AI agents with automated tools for reconnaissance, target analysis, and credential harvesting.
• The operation successfully amassed sensitive data, including 4,493 records comprising email addresses, account numbers, passwords, and API keys, stored in a database called FinancialSoft.
• This incident highlights the growing threat of AI-augmented cyberattacks, enabling smaller groups to scale their operations and automate complex tasks.

A sophisticated cybercrime syndicate has reportedly employed artificial intelligence (AI) agents to orchestrate automated attacks targeting more than 400 banks, payment processors, and other financial entities across Latin America. Cybersecurity firm Straiker detailed these findings in a recent report, revealing that the group, identified as CyberCartel, utilized AI models from providers such as Anthropic, xAI, and Moonshot AI to facilitate various stages of its malicious activities.

The affected organizations, spanning multiple countries, were not individually named by Straiker. The firm’s investigation delved into the operational systems of the threat group itself, rather than confirming successful breaches at every one of the 400+ targeted institutions. The report, titled Hackers Used Claude and Grok to Automate Cyberattacks on Over 400 Banks and Financial Firms, details the group’s “CARLIY0S” system.

Researchers at Straiker identified CARLIY0S as an AI-driven attack framework, not merely a single piece of malware. It was designed to significantly enhance the operational capacity of a small team, enabling them to manage a larger number of targets and reduce the manual effort involved in their attacks. The framework seamlessly integrated various AI models with specialized software, facilitating data sharing and allowing different AI agents to analyze target intelligence, propose attack vectors, and coordinate subsequent actions.

The CARLIY0S Framework

The CARLIY0S system relies on a combination of components, including the PentAGI automated security-testing framework, custom scripts, specific AI model configurations, and other tools. While PentAGI can be legitimately used for authorized security assessments, its integration into CARLIY0S demonstrates its potential for malicious exploitation.

The framework’s architecture involved assigning distinct roles to different AI models. Anthropic’s Claude models, for instance, were tasked with analyzing target information and suggesting attack strategies. Another Claude instance would then review these suggestions and make a final decision on the approach. Grok models from xAI were reportedly instrumental in collecting sensitive data, which was then stored in a proprietary database named FinancialSoft. Moonshot AI’s Kimi models served as a fallback mechanism, stepping in when other AI systems refused to process certain requests, ensuring operational continuity for the attackers.

This multi-agent setup is crucial because it indicates that the AI models were not simply being used as standalone chatbots for isolated queries. Instead, their outputs were directly linked to external tools capable of inspecting web traffic, managing collected data, and executing automated tasks. To circumvent AI safety protocols, Straiker noted that the operators often framed their malicious requests as legitimate security testing or academic research, attempting to mask their true intent from the AI systems.

This incident adds to a growing body of evidence concerning the use of AI agents in cyberattacks, though the specifics of this operation and the evidence gathered by Straiker are distinct from other reported cases.

Operational Mechanics and Data Compromise

Straiker’s analysis of CyberCartel’s internal files and systems revealed that CARLIY0S employed automated browser software and residential proxy services to conduct its operations. The attackers focused on exploiting vulnerabilities in financial organizations’ web systems and, upon gaining access, searched for credentials and other sensitive information.

The group’s FinancialSoft database, reviewed by Straiker, contained a snapshot of 4,493 records. This extensive trove of compromised data included email addresses, bank account numbers, passwords, API keys, and various other access details. Notably, the report also highlighted credentials associated with payment services and critical infrastructure, such as Mexico’s SPEI interbank payment system. While the presence of these records raises significant concerns about potential fraud and further unauthorized access, it does not confirm that every single credential was successfully exploited.

The Broader Implications of AI-Augmented Attacks

This case underscores how AI can dramatically enhance the scalability of traditional cybercrime activities. Tasks like target reconnaissance, managing stolen credentials, and coordinating technical operations can be automated, allowing smaller groups to achieve a wider impact. It is important to clarify that this does not imply AI entirely replaces human attackers; rather, it demonstrates a synergistic model where human operators, automated scripts, infrastructure, and commercial AI models collaborate. The true risk lies in how these diverse components are interconnected and the level of access they are granted.

Straiker’s report also revealed that the attackers had contingency plans in place for instances where an AI model might reject a request, including the use of local code that operated independently of the AI. This adaptability suggests that simply blocking one compromised AI account might not be sufficient to halt the entire operation if the group can switch tools or resort to pre-existing scripts. In response to these findings, Anthropic has reportedly revoked a credential associated with the observed activity, and xAI has been notified and is investigating the reported misuse of its Grok models.

What You Should Do

• Strengthen Identity and Access Management (IAM): Implement robust multi-factor authentication (MFA) across all systems, enforce strong password policies, and regularly audit user permissions, especially for privileged accounts and API keys.
• Segment Networks and Limit Automation Access: Employ network segmentation to compartmentalize critical systems. Restrict the access and privileges granted to any automated tools or services, ensuring they only have the minimum necessary permissions.
• Monitor for Unusual Activity: Enhance monitoring capabilities to detect anomalous account behavior, suspicious API calls, and unusual traffic patterns that could indicate AI-driven reconnaissance or exploitation attempts.
• Review Connected Services and Third-Party Integrations: Conduct thorough security assessments of all connected services, support portals, and third-party payment interfaces, as these can be overlooked entry points for attackers seeking sensitive data.
• Implement Rapid Credential Revocation: Establish and regularly test procedures for immediate revocation of compromised credentials and API keys upon detection of suspicious activity.
• Stay Informed on AI-Assisted Threats: Keep abreast of the latest research and intelligence on AI agents and automated attack frameworks to understand evolving threat landscapes and refine defense strategies.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.