CyberCartel deploys AI-driven CARLIY0S framework against Latin American banks
CARLIY0S
Researchers uncovered that the CyberCartel group utilized multiple AI models in the CARLIY0S campaign to target and attack Latin American financial institutions. Evidence of the operation was discovered within the group's own systems.
- first report
- 21 Oct 2026
- last update
- 21 Oct 2026
Timeline · 1
Sources · 1
News and write-ups
- 2026-10-21CARLIY0S: CyberCartel's AI Attacks on Latin American BanksStraiker · straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-atta
Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.
Classification
- AI role
- AI-enabled attack
- categories
- AI-assisted intrusion
- severity
- 3 · Confirmed exploitation
- targets
- Enterprise deployment
- owasp llm top 10
- no entry for these categories
- mitre atlas
- no technique for these categories
- dates
- happened 21 Oct 2026 · first reported 21 Oct 2026
- origin
- News & research feeds
- record
- confidence 0.90 · created 2026-10-21 17:47Z · updated 2026-11-05 02:33Z
Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned
Copy a brief
This record as a short Markdown brief, for a ticket, a chat or a coding agent.
the brief as text
# CyberCartel deploys AI-driven CARLIY0S framework against Latin American banks https://gcdradar.vercel.app/incidents/cybercartel-deploys-ai-driven-carliy0s-framework-against-lat · AIR-2026-1455 · closed 2026-11-04 - Lane: Breaches & attacks - Severity: 3 (Confirmed exploitation) - Fix status: No fix needed - First reported: 2026-10-21 - AI role: AI-enabled attack - Products: CARLIY0S ## Summary Researchers uncovered that the CyberCartel group utilized multiple AI models in the CARLIY0S campaign to target and attack Latin American financial institutions. Evidence of the operation was discovered within the group's own systems. ## What to do No action recorded; read the sources below and the vendor's advisory. ## Latest updates - 2026-10-21: CARLIY0S: CyberCartel's AI Attacks on Latin American Banks (https://straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-attack-latin-american-banks) ## Sources - 2026-10-21 Straiker: CARLIY0S: CyberCartel's AI Attacks on Latin American Banks https://straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-attack-latin-american-banks Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.
Related
- liveAntiFox Hackers use AntiFox AI agents in AWS credential‑theft attacks
Breaches & attacks · Exploited · since 11 Nov 2026
AI - liveAWS Validating AI‑Discovered Cloud Threats on Live Infrastructure: A Multi‑Model, Multi‑Cloud Study
Research · since 10 Nov 2026
AI - liveBOSSAI AI Agents BOSSAI AI Agents Used to Steal Taipei Emergency Dispatch Records
Breaches & attacks · Real loss · since 2 Nov 2026
AI - liveARTEX AI WorkOS Breached via ARTEX AI Compromise of Internal App
Breaches & attacks · Exploited · since 3 Nov 2026 · updated 9 Nov 2026
AI - liveLLM-based agent tooling China-linked threat groups use AI agents to scale espionage attacks
Breaches & attacks · Exploited · since 3 Nov 2026
AI - liveCursor AI Aur0ra ransomware operators used AI coding agents for intrusion workflows
Breaches & attacks · Real loss · since Aug 2026 (approx.)
AI