Straiker’s October 21, 2026, report alleges that a system called CARLIY0S was used against more than 400 financial targets in Latin America. The company says the targets included banks and payment providers; its figure counts targets of the alleged operation, not confirmed successful breaches.
What Straiker alleges about CARLIY0S
Straiker describes CARLIY0S as an AI-assisted, multi-agent system, meaning multiple software agents coordinated tasks under human direction. It attributes the alleged operation to CyberCartel and associates the group with Tr4nsHack Team and Hexagon Security Labs Mexico.
Straiker says it accessed a September 24, 2026, snapshot of a repository called FinancialSoft. It describes the organizations it identified as victims as anonymized. The report does not assign an exact model or version to each operation stage.
What Straiker says was in FinancialSoft
Straiker says the snapshot contained 4,493 records, including 2,911 email addresses and 903 account numbers. It also reported these categories and counts:
| Reported category | Count Straiker reports |
| General API keys | 391 |
| Credentials associated with an unnamed fintech victim | 43: 11 API keys and 32 cryptographic keys |
| Cleartext passwords | 67 |
| Portal logins | 51 |
| Database connection strings | 43 |
| JWT signing keys | 20 |
| Keycloak credentials | 20 |
| Wasabi S3 credentials | 19 |
| Mailgun credentials | 15 |
| Digital certificates | 4 |
| Explicit backdoors | 6 |
These are counts Straiker reported for the repository; the categories should not be added together as a combined total. Straiker also reported more than 200 vulnerabilities associated with targeted organizations and more than 270 penetration-test reports dated from May through September 2026.
Which models and provider responses Straiker names
Straiker names Claude, Grok and Kimi in its account of the operation. It says Anthropic revoked a credential it characterized as compromised. Straiker also said xAI had been notified and was investigating activity associated with five “Grok miners.”
