CARLIY0S: CyberCartel's AI pipeline hit 400-plus financial targets
CARLIY0S is a criminal attack system that drove Claude and Grok against Latin American banks, fintechs and payment gateways.
· Straiker · Research by STAR Labs Research
CARLIY0S is an AI attack system CyberCartel used against 400-plus Latin American financial targets, Straiker reports. The system drove Claude inside Cursor across four attack roles and fell back to stored exploit code when a model refused.
01What happened
Straiker's STAR Labs Research published its CARLIY0S analysis on October 21, 2026, describing a months-long campaign against Latin American financial institutions run through a criminal AI attack system. Straiker attributes the campaign to the CyberCartel group and says it recovered the operators' own dashboard, which inventoried the victims and the stolen data. Three alleged operators are named in the report: Adx, Roro and aBerry.
02How it works
CARLIY0S is built on the open-source PentAGI framework and uses a commander model running inside the Cursor IDE to delegate work to four specialist roles: STRIKER for exploit and code generation, GHOST for reconnaissance and validation, FABLE for finding lateral movement paths, and MAXIMUS as the final arbiter. Framing each request as sanctioned security work persuaded the commercial models to produce offensive output, which Straiker says convinced them the work was defensive. Whenever a model refused, the orchestrator dropped it and ran pre-written offensive code held in a local file. The stack also drove Playwright headless browsers and reached Burp Suite over MCP, and two operator machines shared one knowledge graph.
03Who is affected
Victims named in the report are Latin American banks, fintech payment gateways and Mexican financial institutions, all anonymized by Straiker. Straiker says the recovered credential set could enable abuse of SPEI, Mexico's interbank payment system. Teams that issue model provider keys without usage monitoring face the exposure the operators relied on, because the campaign ran in part on a compromised Anthropic credential.
04What to do
Rotate model provider keys that may be exposed and check Anthropic and xAI usage and billing records for calls your team did not make. Straiker recommends keeping an inventory of agents and the tools they can reach, watching agent actions at runtime, and keeping an agentic kill switch that can revoke tool access and isolate a session while preserving evidence.
Sources 2 links, all fetched
- 1straiker.aiStraiker Analysis
- 2info.straiker.aiCARLIY0S Threat Report