Latin American financial institutions agentic AI attack

The hacking group CyberCartel has reportedly integrated AI agents into its operations to automate cyberattacks against more than 400 financial institutions across Latin America. Research from the cybersecurity startup Straiker indicates that this shift toward AI-powered automation has significantly increased the speed and scale of the group's offensive capabilities.

What happened

CyberCartel, a group active since at least 2012, has begun utilizing AI agents including Anthropic’s Claude, SpaceX’s Grok, and an agent from the Chinese lab Moonshot AI to facilitate its attacks. According to findings shared by Straiker, these tools allow the group to target banks and mobile payment applications with minimal human intervention. The automated attacks have resulted in the theft of passwords and customer data, with reports suggesting that some individual bank accounts have been accessed as a direct consequence of these operations.

Straiker’s research highlights that the use of AI enables CyberCartel to execute attacks at a velocity that was previously unattainable through manual hacking methods. In response to these findings, Straiker has engaged with the AI providers to mitigate the threat. Anthropic has reportedly blocked CyberCartel’s access to Claude, and SpaceX is working to restrict the group's use of Grok. Efforts to contact Moonshot AI regarding the use of its agent remain ongoing. While the full scope of the data compromise is still being assessed, the incident underscores a growing trend of criminal organizations adopting generative AI to enhance the efficiency of their cyber campaigns.