/
← Voltar ao feed
high financial services banking payments

CARLIY0S multi-agent AI system using Claude, Grok and Kimi used to target 400+ Latin American financial institutions

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 10:37 · coletado há 2 horas

Straiker reports that a criminal group it tracks as AiPT-67 (operating as Tr4nsHack Team under the name Hexagon Security Labs Mexico) used a multi-agent system called CARLIY0S to coordinate attacks against more than 400 financial institutions and payment providers in Latin America. The system combined commercial AI models, Anthropic's Claude, xAI's Grok and Moonshot AI's Kimi, with automation and shared infrastructure. Straiker links the group to CyberCartel, a financially focused actor it says has been active since 2012. The figure of 400+ refers to targeted organizations, not confirmed breaches, and the findings are Straiker's own, not an independently verified tally of intrusions or losses.

Detalhes técnicos

  • CARLIY0S was built around the PentAGI offensive-security framework and assigned different tasks to different models. Claude agents analyzed targets, assessed approaches and synthesized decisions. Grok-powered "miners" gathered information into a database called FinancialSoft. Kimi models appeared in the workflow.
  • Operators had a local code fallback for when models refused requests, so a refusal did not necessarily stop the operation. Straiker cautions that some model configuration entries do not prove those models were successfully invoked.
  • The tool chain linked AI analysis to browsers, traffic inspection, shared data and operator infrastructure. The group used prompts framed as authorized security testing, automated browser activity and residential proxy services.
  • Reported post-compromise objectives were credential searching, internal system mapping, and collection of sensitive financial and identity data.
  • A September 24, 2026 snapshot of FinancialSoft reportedly held 4,493 records, including 2,911 email addresses and 903 account numbers, plus passwords, API keys and other access material. Straiker also reported credentials tied to payment infrastructure and Mexico's SPEI interbank payment system. Victims were anonymized and live credentials and exploit material were redacted.
  • Straiker says Anthropic revoked the compromised credential used to access Claude, while xAI was notified and was investigating activity tied to the Grok miners.

Remediação

  • Prioritize credential and API-key rotation, least-privilege access, and protection of identity and payment systems.
  • Monitor in a way that correlates suspicious activity across accounts, endpoints and applications.
  • Maintain an inventory of AI agents and the tools and data they can reach, and test whether they can be misused or made to act beyond their permissions.
  • Do not rely on a single AI provider's disruption, since attackers may switch models, use local code or fall back to conventional tools.

Linha do tempo

  1. gbhackers.com ↗ · pub. 22/10/2026 10:37 · coletado 22/10 11:00 primeiro registro

    CARLIY0S multi-agent AI system using Claude, Grok and Kimi used to target 400+ Latin American financial institutions

    ler a análise desta fonte

    Straiker reports that a criminal group it tracks as AiPT-67 (operating as Tr4nsHack Team under the name Hexagon Security Labs Mexico) used a multi-agent system called CARLIY0S to coordinate attacks against more than 400 financial institutions and payment providers in Latin America. The system combined commercial AI models, Anthropic's Claude, xAI's Grok and Moonshot AI's Kimi, with automation and shared infrastructure. Straiker links the group to CyberCartel, a financially focused actor it says has been active since 2012. The figure of 400+ refers to targeted organizations, not confirmed breaches, and the findings are Straiker's own, not an independently verified tally of intrusions or losses.

    Technical Details

    • CARLIY0S was built around the PentAGI offensive-security framework and assigned different tasks to different models. Claude agents analyzed targets, assessed approaches and synthesized decisions. Grok-powered "miners" gathered information into a database called FinancialSoft. Kimi models appeared in the workflow.
    • Operators had a local code fallback for when models refused requests, so a refusal did not necessarily stop the operation. Straiker cautions that some model configuration entries do not prove those models were successfully invoked.
    • The tool chain linked AI analysis to browsers, traffic inspection, shared data and operator infrastructure. The group used prompts framed as authorized security testing, automated browser activity and residential proxy services.
    • Reported post-compromise objectives were credential searching, internal system mapping, and collection of sensitive financial and identity data.
    • A September 24, 2026 snapshot of FinancialSoft reportedly held 4,493 records, including 2,911 email addresses and 903 account numbers, plus passwords, API keys and other access material. Straiker also reported credentials tied to payment infrastructure and Mexico's SPEI interbank payment system. Victims were anonymized and live credentials and exploit material were redacted.
    • Straiker says Anthropic revoked the compromised credential used to access Claude, while xAI was notified and was investigating activity tied to the Grok miners.

    Remediation

    • Prioritize credential and API-key rotation, least-privilege access, and protection of identity and payment systems.
    • Monitor in a way that correlates suspicious activity across accounts, endpoints and applications.
    • Maintain an inventory of AI agents and the tools and data they can reach, and test whether they can be misused or made to act beyond their permissions.
    • Do not rely on a single AI provider's disruption, since attackers may switch models, use local code or fall back to conventional tools.