CyberCartel hit 400 Latin American institutions

Straiker linked a group known as CyberCartel to the use of artificial intelligence agents to automate attacks against more than 400 Latin American institutions, including financial firms, banks and payment apps. The available information, however, does not establish CyberCartel as a state actor or an APT group.

What did Straiker reconstruct about CARLIY0S?

Straiker reconstructed how CARLIY0S worked, a system that allegedly coordinated tasks between Claude, Grok and Kimi based on files from the group itself and more than 270 reports of alleged security tests dated between May and September 2026. According to El Economista México, that material was the basis for describing how the scheme operated.

The reconstruction points to automation of intrusion-oriented tasks, but the available material does not specify how many attacks were actually successful. ITzine, in its coverage of the case, also said that figure was not confirmed.

What evidence did Straiker cite?

Mallory.ai said the evidence included a copy of a database called FinancialSoft with 4,493 records. The same source clarified that number does not equal confirmed victims and that the organizations involved were not publicly identified.

ITzine added that the copy of that database would have been obtained on September 24, 2026. According to that report, the dataset contained 2,911 email addresses and 903 account numbers, although it still did not confirm how many intrusions succeeded.

What scope did the media report?

Tom's Hardware reported that the campaign attributed to CyberCartel affected more than 400 Latin American institutions, including banks and payment applications. El Economista México spoke of more than 400 financial targets in Latin America, while Mallory.ai noted that the target count should not be read as confirmed victims.

The information gathered in those reports presents CyberCartel as a group focused on the regional financial sector, but without confirmed attribution to a state or public identification of the affected organizations. At the same time, the research material places this case within a broader pattern of recent activity against Latin American entities, although that angle adds no further verifiable details about CyberCartel.