CyberCartel Used AI Against 400 Financial Targets

Straiker identified CyberCartel as a fraud group operating in Latin America that allegedly used CARLIY0S to coordinate offensive tasks with commercial AI models and programs capable of carrying out digital actions. The report, carried by El Economista, included targets in Mexico, although incidents filed with Banco de México or the CNBV do not officially attribute the cases to CyberCartel.

What did Straiker describe about CARLIY0S?

Straiker said CARLIY0S may have operated as a multiagent system, with models and agents coordinating tasks under human direction. NeoTeo also noted that the research was presented as an allegation and clarified that the more than 400 targets do not necessarily mean confirmed successful breaches.

Material attributed to Straiker was later picked up in other technical and industry summaries. Brandefense said CARLIY0S may have assigned different functions to Claude, Grok, and Kimi models during operations against Latin American financial targets. An independent analysis, meanwhile, said the material included a database with 4,493 records, among them 903 account numbers, as well as payment system API keys, cryptographic keys, identity provider credentials, and database connections.

What is known about the scope and Mexico?

The reported scope covers more than 400 financial targets across Latin America, but attribution to specific victims or concrete losses remains unresolved. In Mexico, El Economista said targets in the country were included, though incidents reported to Banco de México or the CNBV do not officially attribute the events to CyberCartel.

The independent analysis warned that there was no public audit of emptied accounts and not enough evidence to confirm verified financial losses. Agentic Cyber Explorer also described the case as a security vendor investigation based on material from the attackers' environment, with anonymized victims and no complete independent verification of the findings.

How does this case fit into digital fraud seen in Mexico?

Ultra Noticias reported, using data from the Executive Secretariat of the National Public Security System, that 47,288 fraud investigations were opened in Mexico between January and May 2026. Of that total, Mexico City accounted for 9,075 and the State of Mexico for 7,603.

The same coverage linked the risk to deepfakes used to impersonate identities and request transfers or confidential information. Red Financiera, citing the Secretariat of Security and Citizen Protection, also said deepfake-related cases rose 700% in Mexico, although the available results do not show a direct link to the official SSPC figure.

What offensive and defensive AI uses did Dell and AMD mention?

DPL News reported that Dell and AMD specialists described offensive uses of AI for targeted spear phishing and voice imitation through deepfakes, along with defensive uses for classifying alerts, detecting threats through natural language, and automating security operations center tasks.

The coverage referred to general risks and capabilities for organizations, without documenting a specific Mexican incident. In that same context, the available material on CyberCartel and the reports on fraud and deepfakes point to two separate levels: a case attributed to a specific group, still without full official confirmation in Mexico, and broader warnings about how these tools are being used in financial operations and in SOCs.