CyberCartel Used AI Framework CARLIY0S to Target Over 400 Latin American Financial Firms

CyberCartel used an AI-driven framework called CARLIY0S to coordinate attacks against more than 400 banks, payment providers and other financial organizations across Latin America, according to security firm Straiker. The framework combined Claude, Grok and Kimi models with automated testing tools, scripts and shared data to help human operators analyze targets, coordinate activity and collect sensitive information. Alternative models and local code were available when models rejected requests, indicating that safeguards on individual services did not necessarily halt the operation.

Straiker based its findings on evidence from its own systems and a review of the group’s systems, including a FinancialSoft database snapshot containing 4,493 records. The report did not name the targeted institutions or establish that every target was successfully breached; the target count should not be interpreted as a confirmed victim count. Anthropic revoked a credential associated with the activity, while xAI was notified and was investigating the reported use of Grok. The findings highlight the use of multiple AI services to support human-directed financial-sector attacks rather than demonstrate fully autonomous compromise.