xAI

AI security vendor Straiker reports that a group it links to the long-running CyberCartel operation, working as Tr4nsHack Team, built a multi-agent system called CARLIY0S on the open-source PentAGI framework and used it against more than 400 financial targets in Latin America. Straiker says the group assigned fixed roles to Claude Opus models through the Anthropic API, used Grok for collecting secrets, got past model safeguards by framing requests as authorized red-team or academic work, and fell back to pre-written code when Kimi and Sonnet models refused. This is a vendor investigation built on material from the group's own environment; victims are anonymized, and BusinessToday notes the findings have not been independently verified.

CrowdStrike Intelligence reports a campaign against South Korean financial organizations, active from late September to early October 2026, that resulted in exfiltrated data, and says open directories on actor-controlled servers held Claude Code session histories, ARTEX configuration files and Claude memory files. CrowdStrike assesses with moderate confidence that the unattributed actor is a financially motivated Chinese speaker, and says the ARTEX instance used DeepSeek v4.1-flash as its main model, with GLM-5.3 and Grok 4.6 used in further Claude Code sessions. Press reports name Shinhan Bank, KB Kookmin Bank and Hana Bank among the victims; press reports at least seven institutions and about 68,000 people, while CrowdStrike calls the number of affected organizations unconfirmed.