gcdRadar
closedclosed 4 Nov 2026Breaches & attacks3 Confirmed exploitationAI

CyberCartel deploys AI-driven CARLIY0S framework against Latin American banks

CARLIY0S

Researchers uncovered that the CyberCartel group utilized multiple AI models in the CARLIY0S campaign to target and attack Latin American financial institutions. Evidence of the operation was discovered within the group's own systems.

first report
21 Oct 2026
last update
21 Oct 2026

Timeline · 1

  1. 21 Oct 2026CARLIY0S: CyberCartel's AI Attacks on Latin American Banks

Sources · 1

News and write-ups

  1. 2026-10-21
    CARLIY0S: CyberCartel's AI Attacks on Latin American Banks
    Straiker · straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-atta

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

AI role
AI-enabled attack
categories
AI-assisted intrusion
severity
3 · Confirmed exploitation
targets
Enterprise deployment
owasp llm top 10
no entry for these categories
mitre atlas
no technique for these categories
dates
happened 21 Oct 2026 · first reported 21 Oct 2026
origin
News & research feeds
record
confidence 0.90 · created 2026-10-21 17:47Z · updated 2026-11-05 02:33Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# CyberCartel deploys AI-driven CARLIY0S framework against Latin American banks

https://gcdradar.vercel.app/incidents/cybercartel-deploys-ai-driven-carliy0s-framework-against-lat · AIR-2026-1455 · closed 2026-11-04

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2026-10-21
- AI role: AI-enabled attack
- Products: CARLIY0S

## Summary

Researchers uncovered that the CyberCartel group utilized multiple AI models in the CARLIY0S campaign to target and attack Latin American financial institutions. Evidence of the operation was discovered within the group's own systems.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-21: CARLIY0S: CyberCartel's AI Attacks on Latin American Banks (https://straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-attack-latin-american-banks)

## Sources

- 2026-10-21 Straiker: CARLIY0S: CyberCartel's AI Attacks on Latin American Banks https://straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-attack-latin-american-banks

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. live
    AntiFox Hackers use AntiFox AI agents in AWS credential‑theft attacks

    Breaches & attacks · Exploited · since 11 Nov 2026

    AI
  2. live
    AI
  3. live
    AI
  4. live
    ARTEX AI WorkOS Breached via ARTEX AI Compromise of Internal App

    Breaches & attacks · Exploited · since 3 Nov 2026 · updated 9 Nov 2026

    AI
  5. live
    AI
  6. live
    Cursor AI Aur0ra ransomware operators used AI coding agents for intrusion workflows

    Breaches & attacks · Real loss · since Aug 2026 (approx.)

    AI