Criminals are using AI to scale up attacks. Your logins are the target.

If the button does not work, use your browser's print command.

In short: A security firm says a crime group used several AI tools to attack more than 400 banks and other financial targets in Latin America. The lesson for us is simple: protect your logins, and never hand over a code.

Think you've been scammed? Act now. It's not your fault.

Lost money or shared bank details? Call your bank or card provider straight away and ask them to stop any transactions. Use the number on the back of your card or in your banking app.
Report it to Scamwatch (scamwatch.gov.au/report-a-scam).
Cybercrime (hacked account, stolen money or data, extortion)? Report it to police through ReportCyber (cyber.gov.au/submit-a-report).
Your identity details have been misused or stolen? Call IDCARE free on 1800 595 160.
Need urgent cyber help? Call ASD's Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371). It's open 24 hours a day, 7 days a week.
Someone is in danger right now? Call 000.

Be careful of anyone who offers to get your money back for a fee. That is usually another scam.

What's happening

On 21 October (US time), US security company Straiker published research on a criminal group it calls CyberCartel. According to Straiker:

the group built a system that gave different jobs to commercial AI models, mainly Anthropic's Claude and xAI's Grok. Straiker says Kimi models were also set up, but refused the attack requests;
it used that system against more than 400 financial targets over a few months;
to get past the AI tools' safety rules, it pretended its requests were authorised security tests.

Straiker says it accessed a snapshot of the group's stolen-credential database on 24 September. The snapshot held 4,493 records, and the haul included about 2,900 email addresses and 900 bank account numbers. Straiker says Anthropic has revoked the login the group used to reach Claude, and xAI is looking into the activity.

What we don't know

The victims aren't named.
The report doesn't say how many attacks succeeded. "400 targets" doesn't mean 400 banks were breached.
Straiker sells security products, so this is vendor research.

Who's at risk

Everyone with online banking, email or shopping accounts. Stolen logins and email addresses are what these groups collect.
Small businesses whose staff can approve payments.

What to do

Never share a password or one-time code with anyone who contacts you, even if they say they're from your bank.
If a message says there's a problem with your account, don't use its link or phone number. Open your bank's app, or call the number on your card.
Use a strong password for your email that you don't use anywhere else, and turn on two-step sign-in (also called multi-factor authentication) for your email and banking.
Expect scams to look polished. Perfect spelling no longer means a message is safe.

Why it matters in Australia

ASIC says artificial intelligence is "super-charging online scam threats". In the 2025/26 financial year, ASIC removed more than 19,400 online scams, including fake websites, social media ads and phishing scams. That's up 182% on the year before (ASIC media release 26-195MR).

Report it / get help

Shared your details or lost money? Call your bank now.
Report it to Scamwatch (scamwatch.gov.au/report-a-scam), or to police through ReportCyber (cyber.gov.au/submit-a-report).
Identity misused? Call IDCARE free on 1800 595 160.

Sources

Straiker, "Inside CARLIY0S: How CyberCartel Used Multiple AI Models to Attack 400+ Latin American Banks and Financial Institutions", 21 Oct 2026. https://www.straiker.ai/blog/inside-carliy0s-how-cybercartel-used-multiple-ai-models-to-attack-latin-american-banks (vendor research. checked 22 Oct 2026)
Scamwatch, "Phishing scams". https://www.scamwatch.gov.au/types-of-scams/phishing (checked 22 Oct 2026)
ASIC Moneysmart, "Investment scams (for the "super-charging" quote)", last updated 14 Oct 2026. https://moneysmart.gov.au/financial-scams/investment-scams (checked 22 Oct 2026)
Scamwatch, "Report a scam". https://www.scamwatch.gov.au/report-a-scam (checked 22 Oct 2026)
IDCARE, "Get help". https://www.idcare.org/contact/get-help (checked 22 Oct 2026)
ASIC, "media release 26-195MR, ASIC warns scammers are using AI to spin vast webs of deception", Oct 2026. https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2026-releases/26-195mr-asic-warns-scammers-are-using-ai-to-spin-vast-webs-of-deception (19,400+ removals, up 182%. checked 22 Oct 2026)
NCSC (UK), "Top tips for staying secure online". https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online (strong, separate email password; 2-step verification. checked 22 Oct 2026)
NCSC (UK), "Spotting scams". https://www.ncsc.gov.uk/collection/phishing-scams/spot-scams (It used to be easier to spot scams. They might contain bad spelling or grammar. But scams are getting smarter. checked 22 Oct 2026)
Scamwatch, "How scammers use technology and AI". https://www.scamwatch.gov.au/stop-check-protect/help-to-spot-and-avoid-scams/how-scammers-use-technology-and-ai (Scammers use technology and artificial intelligence (AI) to make scams more convincing. checked 22 Oct 2026)

General information only, not advice. Disclaimer · Spotted an error? Corrections policy · Written by SEVNworks, a Sydney studio that builds websites and AI workflows. · SEVN Works Pty Ltd, ABN 84 677 263 035 · Privacy policy