25,000: Customers Affected as Hackers Automate Bank Attacks

For more than a decade, a hacking collective known as CyberCartel has targeted Latin American businesses, but recent research shows a sharp change in tactics. The group is now using AI agents to automate attacks on banks and mobile payment applications, allowing them to strike more organizations at a faster pace than human-only operations could achieve.

Straiker, a cybersecurity startup, revealed that the group has been active since at least 2012. In recent months, the adoption of AI has expanded the group's reach. Criminals have stolen passwords and customer data, and they have accessed individual bank accounts with minimal direct involvement. The specific tools include Grok from SpaceX, Claude from Anthropic, and an agent from the Chinese lab Moonshot AI.

The security firm shared its findings with both SpaceX and Anthropic. Anthropic has already blocked the group's access to Claude, while Straiker is still attempting to contact Moonshot AI. The incident exposed vulnerabilities in standard AI safeguards, which are typically designed to refuse cyberattack requests. CyberCartel reportedly bypassed these defenses by claiming the models were running in test environments. When one model refused, the hackers switched to another. If that model also refused, the agents were assigned to deploy malware instead.

Straiker noted that the group did not use Anthropic's Mythos model. Anthropic had warned earlier in the year that Mythos and similar models could be exploited for this type of attack. The company also disclosed in November 2025 that its AI was used in a prior cyberattack. Later, researchers used Claude to test the security of rival OpenAI, though that specific operation was not criminal.

The timing of the report coincides with a parallel investigation in South Korea. Authorities are examining similar issues affecting local banks, including Hana Bank, KB Kookmin Bank, and Shinhan Bank. The personal credit information of at least 25,000 Shinhan Bank customers has been leaked in that incident.

Industry players are responding to the threat. Nvidia recently launched the Open Agent Safety Platform, a system designed to contain rogue AI agents. The platform uses a new hardware and software security stack to prevent agents from escaping sandboxes or executing unauthorized code. It aims to stop agents from gaining access to critical infrastructure or bypassing existing guardrails.