Straiker: Hacker group used multiple AI models in campaign against more than 400 banks

On October 21, 2026, security firm Straiker published an investigation into a group called CyberCartel and its tool CARLIY0S, which the firm describes as a swarm of AI models. According to Straiker, the campaign targeted more than 400 banks and financial institutions in Latin America over several months, from May to September 2026.

Straiker says the firm gained access to the group's infrastructure on September 24, 2026, and that the investigation is based on evidence from there.

Multiple AI models in play

According to Straiker, the attackers used several different AI models: multiple versions of Claude, five so-called "Grok miners" for harvesting login credentials, and Kimi models as a fallback.

To get around the models' safety guardrails, the attackers framed their requests as authorized red team work (an agreed-upon exercise in which an organization tests its own systems), academic penetration testing or a vulnerability program. Straiker calls this "dual-use contextual framing," meaning a request is wrapped so that it looks like legitimate security work.

If a secondary model refused a request, the system, according to Straiker, fell back on a local file of pre-assembled attack code that the operators had written themselves.

What was stolen?

Among the data Straiker describes were 4,493 login records from a "FinancialSoft" database. They included 2,911 email addresses, 903 account numbers and 67 plaintext passwords.

According to Straiker, the group also had more than 270 penetration test reports, more than 200 zero-day exploits (vulnerabilities that the developers do not yet know about), 43 sets of credentials for fintech systems, 391 general API keys, 20 JWT signing keys and 6 backdoors.

Reactions

According to Straiker, Anthropic has revoked the compromised access key for Claude, cutting off the swarm's access. xAI has been notified and is investigating. Straiker says both responded quickly.

Straiker recommends, among other things, continuous testing of AI agents against real-world attacks, security that monitors the AI's behavior, visibility into agents' access, monitoring across cloud and SaaS, and an "agentic kill switch."

Straiker itself sells security for AI agents, and the findings and recommendations are the firm's own. They have not been independently confirmed.