AI CYBERATTACKS TARGET 400+ LATIN AMERICAN BANKS

In brief:

₿- A cybercrime group reportedly used CARLIY0S, a multi-agent AI system, to coordinate cyberattacks against more than 400 Latin American banks and financial institutions.

₿- The campaign exposed banking credentials, fintech APIs and payment infrastructure, highlighting the growing threat of AI-powered cybercrime to Latin America’s financial sector.

Cybersecurity firm Straiker has reported that CyberCartel, a cybercrime group, used an AI system called CARLIY0S to coordinate cyberattacks against more than 400 banks, fintech companies and payment providers across Latin America. The investigation reveals how AI-powered cyberattacks are evolving as criminal groups combine multiple AI models with automated tools to scale reconnaissance, identify vulnerabilities and pursue access to financial systems.

The operation reportedly used commercial AI models from Anthropic, xAI, and Moonshot AI, integrated into a multi-agent framework that divided tasks among specialised agents. Rather than relying on a single chatbot, the system coordinated analysis, attack planning and decision-making within a broader cybercrime workflow.

How CyberCartel used AI agents to coordinate cyberattacks

AI Cyberattacks Target 400+ Latin American Banks — Image via Magnific

According to Straiker, the group operated as Tr4nsHack Team under the name Hexagon Security Labs Mexico. Its CARLIY0S framework reportedly used PentAGI, an open-source automated offensive-security platform, to connect AI-generated analysis with scripts, shared operational data and security-testing tools.

Investigators accessed a snapshot of the group’s systems on 24 September 2026. The findings included a database called FinancialSoft containing 4,493 records reportedly collected using five tools described as “Grok miners”.

The inventory included 2,911 email addresses, 903 account numbers, passwords, API keys and other sensitive authentication material. Straiker also reported more than 200 vulnerabilities, including alleged zero-day flaws affecting targeted organisations. The presence of these records does not independently establish that every target was breached or every exposed credential was exploited.

Why AI-powered cybercrime threatens financial institutions

The reported operation highlights the risks of connecting AI agents to systems that can access sensitive information or interact with real infrastructure. Straiker described automated browser activity, residential proxy networks and techniques intended to make malicious requests appear to be legitimate security testing.

The exposed materials included credentials linked to Mexico’s Sistema de Pagos Electrónicos Interbancarios (SPEI), the country’s interbank payment system. Such access could increase the risk of financial fraud, unauthorised transactions and further compromise if the credentials remained valid.

Straiker said Anthropic revoked a compromised credential associated with the operation, while xAI was notified and was investigating activity linked to the reported Grok miners.

How banks can defend against AI-driven cyberattacks

The CARLIY0S investigation demonstrates how AI can help cybercriminals coordinate familiar attack techniques at greater speed and scale. However, human operators, compromised credentials, vulnerable applications and operational infrastructure remain central to the reported activity.

Financial institutions should strengthen API security, enforce least-privilege access, rotate exposed credentials and monitor suspicious activity across payment systems, identity providers and cloud services. Organizations deploying AI agents should also restrict tool permissions, test for misuse and establish mechanisms to suspend compromised agents quickly.

As AI-assisted cybercrime develops, effective defence will depend on detecting coordinated malicious behaviour, containing compromised access and responding before attacks disrupt critical financial services.

Could cryptocurrency reduce reliance on traditional banks

Cryptocurrency and blockchain technology could offer an alternative way to reduce reliance on traditional banking infrastructure, particularly for cross-border payments and digital asset transfers. Public blockchains can enable peer-to-peer transactions without requiring every transfer to pass through a central bank or commercial bank.

Cryptographic verification and transparent on-chain records can also improve transaction traceability, while self-custody wallets allow users to retain control of their assets without holding funds in a bank account or on a centralised exchange. However, crypto is not immune to cybercrime: compromised private keys, phishing, vulnerable smart contracts and attacks on centralised exchanges create their own risks. Blockchain can reduce certain points of centralized dependence, but it cannot eliminate the need for strong security practices or protect every part of the financial ecosystem.

Disclaimer: The content of this article is for informational purposes only and does not constitute financial, investment, or trading advice. Readers should conduct their own research and consult a qualified cryptocurrency advisor before making any investment decisions.

Stay informed,
Rodcas Consulting Group