Criminal Network Attacked 400 Banks and Fintechs in Latin America Using AI

A criminal network attacked 400 banks and financial companies in Latin America, collecting thousands of sensitive data. The cybersecurity firm Straiker revealed the case on October 21, 2026, identifying the group as CyberCartel, active since 2012, which operated under the name Tr4nsHack Team. They used a system called CARLIY0S, which integrated artificial intelligence models from Anthropic, xAI, and Moonshot AI. On September 24, researchers accessed the FinancialSoft database, where the group stored 4,493 records, including 2,911 email addresses, 903 CLABE numbers, 391 access keys, and 67 plaintext passwords. Credentials for portals, cryptographic keys, and more than 200 vulnerabilities, including zero-day flaws, were also found. The group was primarily interested in credentials related to SPEI, Mexico's interbank payment system, which could facilitate unauthorized operations. Although they attacked more than 400 entities, only Mexico was identified as the affected country. After the incident, Anthropic revoked the credentials used to access Claude, and xAI began investigating the activity of five agents. The risk persists even after vulnerabilities were patched, as stolen credentials may still provide access to financial systems.