Hackers Used Claude and Grok to Automate Cyberattacks on Over 400 Banks and Financial Firms

A cybercrime group used artificial intelligence (AI) agents to coordinate attacks against more than 400 banks, payment providers and other financial organizations across Latin America, according to a report by cybersecurity company Straiker.

The group, known as CyberCartel, reportedly used AI models from Anthropic, xAI and Moonshot AI to help plan and carry out parts of its operations. The reported targets span several countries, but Straiker did not name the institutions.

Researchers said the system, called CARLIY0S, was built to help a small team handle more targets and reduce the time spent on manual tasks.

It connected AI models with software and shared data, allowing different agents to review target information, suggest actions and help coordinate activity.

The report describes an investigation of the group’s own systems, rather than a claim that every one of the more than 400 targets was successfully breached.

Straiker researchers identified CARLIY0S and linked it to operators working as the Tr4nsHack Team under the name Hexagon Security Labs Mexico.

It is best described as an AI-driven attack framework, not a single malware file. The report says the system relied on PentAGI, an automated security-testing framework, alongside scripts, AI model settings and other tools.

Security News readers can learn more about PentAGI’s automated testing framework, which can be used for authorized security work but may be misused.

Hackers Used Claude and Grok

The report describes a system in which Claude models were assigned separate roles. Some analyzed target information and proposed ways forward; another reviewed suggestions and returned a final decision.

The framework also used Grok models, which Straiker says helped collect secrets into a database called FinancialSoft. Moonshot AI’s Kimi models were also part of the setup, including as a fallback when other systems refused requests.

This arrangement matters because the models were part of a larger workflow, not simply used as chatbots to answer occasional questions.

The system linked model output to tools that could inspect web traffic, manage data and support automated tasks. Straiker says the operators framed requests as authorized testing or academic work, a tactic intended to make harmful requests appear legitimate to AI systems.

The case adds to wider reporting on Claude agents used in cyberattacks, though the activity and evidence in that reporting are separate.

Straiker’s report says CARLIY0S used automated browser software and residential proxy services as part of its operations. It also describes attempts to exploit financial organizations’ web systems and search for credentials and sensitive information after gaining access.

These details come from the company’s review of the group’s files and systems; the report does not publicly identify the affected organizations. Straiker says it removed or altered sensitive data in the published material.

The group’s collected information reportedly included email addresses, account numbers, passwords, API keys and other access details. Straiker counted 4,493 records in the FinancialSoft database snapshot it reviewed.

The report also describes credentials linked to payment services and infrastructure, including Mexico’s SPEI interbank payment system. The presence of such records raises the risk of fraud or further access, but does not by itself confirm that every credential was used successfully.

Why the finding matters

The case shows how AI can help criminals scale familiar activities, such as researching targets, working with stolen credentials and coordinating technical tasks.

It does not mean AI independently selected every target or carried out every step without people. Straiker’s findings point to a system where human operators, scripts, infrastructure and commercial AI models worked together.

That distinction is important: the risk comes from how these parts are connected and what access they are allowed to use. The report also notes that the operators had fallback methods when an AI model rejected a request, including local code that did not depend on a model.

That means a provider blocking one account may disrupt access to a service, but may not stop the wider operation if the group can switch tools or use existing scripts.

Straiker says Anthropic revoked a credential linked to the activity, while xAI was notified and was investigating the reported use of Grok.

For defenders, the practical response is to protect identity and payment systems, limit the access granted to automated tools, and watch for unusual account or API activity.

Financial firms should review connected services as well as core banking systems, since support portals and payment interfaces may also hold sensitive data.

Security teams can also study related reporting on AI agents and attack automation and AI-assisted attack frameworks, while treating each investigation’s evidence and scope separately. The investigation is a warning about the speed and reach that automation can add to cybercrime.

It is not proof that AI has replaced human attackers; rather, AI appears to have helped CyberCartel organize work across a broad set of targets. For banks and payment firms, strong access controls, careful monitoring and rapid credential revocation remain central defenses.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Used Claude and Grok to Automate Cyberattacks on Over 400 Banks and Financial Firms appeared first on Cyber Security News.