A newly exposed cybercrime framework—dubbed CARLIY0S—has enabled a group known as CyberCartel to orchestrate attacks on over 400 banks, payment providers, and financial institutions in Latin America. Cybersecurity company Straiker uncovered the system, which uses AI agents from Anthropic, xAI, and Moonshot AI to coordinate research, automation, and credential theft. Though not all targets were confirmed breached, the breadth and sophistication of the setup mark a significant escalation in cyberattack capabilities.
Multi-Agent AI Pipeline at the Heart of Operations
CARLIY0S operates as an AI-driven attack framework, not just a piece of malware. It combines automated tools, scripts, and several AI models to divide and conquer tasks. Claude models are assigned roles—some analyze target info, others decide on strategy. Grok and Moonshot AI’s Kimi systems handle other tasks like collecting secrets into a database dubbed FinancialSoft or operating as fallbacks when primary models refuse certain inputs. Output from these models links directly to automation tools for browsing, data handling, and discovering credentials.
Scope, Methods, and Risk Landscape
The attackers used the system to narrow time on manual work, effectively scaling their operations. CARLIY0S integrates PentAGI—normally a security-testing framework—and exploits software and AI configurations to streamline phases like reconnaissance and penetration. The framework uses residential proxy services and automated browser tools, and it attempts to access financial sites and support portals following initial gains.
In one snapshot of the FinancialSoft database, Straiker found over 4,400 records containing items like email addresses, passwords, API keys, account numbers, and infrastructure credentials, including links to Mexico’s SPEI interbank payment system. However, possession of this data doesn’t necessarily mean all credentials were successfully leveraged.
Defensive Gaps & What Can Be Done
Key weak points include insufficient access limits for automated tools and broadly permissive interactions between AI agents and infrastructure. CyberCartel managed to make requests look legitimate by framing them as academic or security research tasks—manipulating policies and human review thresholds in AI models.
Responses are underway: Anthropic revoked a credential tied to the framework, while xAI is investigating Grok’s alleged misuse. From a defensive standpoint, financial firms are urged to lock down access to support portals and APIs, watch for anomalous account behavior, and review identity management systems. Core banking systems alone aren’t enough protection when credential leaks affect peripheral services and payment infrastructure.
Bridgework between AI, scripts, and infrastructure has turned what used to be labor-intensive attacks into scalable operations. It doesn’t mean AI is autonomous—the human element is deployed strategically. But the risk is very real: when AI agents are granted too much authority without oversight, the potential for misuse accelerates dramatically. Organizations need to assume attackers can—and are—abusing AI to scale up, and put in place tighter access controls, stronger monitoring, and ready mechanisms for revoking credentials the moment something looks off.
