Loading story…
A fraud operation tracked as REF6045 is targeting users across Mexico’s financial ecosystem with fake CAPTCHA ClickFix lures that trick victims into pasting a malicious command into the Windows Run dialog. The multi-stage infection chain installs a PowerShell-based toolkit called SCMBANKER, establishes persistence, and can optionally deploy Remote Utilities Host for full remote access. Researchers said the campaign has targeted banks, fintechs, payment processors, cryptocurrency exchanges, investment platforms, tax services, and telecom providers, and has likely been active since at least October 2025.
Once installed, SCMBANKER monitors banking sessions, captures screenshots and keystrokes, redirects browsers to phishing pages, displays fake bank warning overlays to push victims into vishing calls, and hijacks clipboard data including CLABE and payment card numbers. Elastic Security Labs said an operational security failure exposed parts of the attackers’ infrastructure, including open directories, a leaked web-root archive, and an unauthenticated file editor tied to 68.211.161[.]46, allowing investigators to recover extensive tooling. The recovered code also showed strong signs of AI-assisted development, likely drafted in Spanish and later manually obfuscated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-01, Elastic Security Labs published its analysis of REF6045, describing a Mexican banking fraud campaign using ClickFix-style fake CAPTCHA lures to deploy SCMBANKER. The report detailed capabilities including banking-session monitoring, screenshot capture, phishing redirection, clipboard hijacking, vishing overlays, and optional Remote Utilities deployment, and noted signs of AI-assisted development.
During the investigation, Elastic recovered extensive REF6045 tooling after the operators exposed open directories, a leaked web-root archive, an unauthenticated file editor, and an open directory at 68.211.161[.]46. The exposed infrastructure revealed details of the SCMBANKER infection chain and operator tooling.
Elastic Security Labs assessed that the PowerShell-based banking fraud toolkit SCMBANKER has likely been in use since at least October 2025 as part of the REF6045 operation targeting Mexico's financial ecosystem.
On 2026-06-18, Elastic Security Labs discovered the Mexican banking fraud operation tracked as REF6045 after observing suspicious bitsadmin activity. The investigation tied the activity to fake CAPTCHA ClickFix lures that install the SCMBANKER toolkit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceelastic.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported multiple **ClickFix** campaigns using fake CAPTCHA or reCAPTCHA prompts to trick users into manually running malicious commands, with payloads tailored by platform and victim profile. On Windows, one campaign delivered a modular NodeJS-based RAT and infostealer through a malicious MSI installer, loading key capabilities only in memory after command-and-control was established and using `gRPC` over Tor for persistent communications. An operational security failure exposed the malware’s backend protocol definitions and admin panel API, revealing a malware-as-a-service operation with multi-operator support, Telegram alerts, automation rules, and cryptocurrency wallet tracking. The malware also fingerprinted victims extensively and established persistence through the Windows Run registry key as **LogicOptimizer**. A separate ClickFix chain attributed with high confidence to **Grandoreiro** targeted users of eight Brazilian banks by luring victims through a fake reCAPTCHA page and launching a malicious PowerShell sequence that sideloaded a Delphi banking trojan with legitimate GoToMeeting and Nero binaries. The malware deployed banking overlays, intercepted **PIX** QR-code payments, added Microsoft Defender exclusions, and stole credentials, device information, signatures, and payment confirmation codes. Netskope also documented a macOS variant that used AppleScript and a persistent fake password dialog to harvest Keychain data, browser cookies, saved credentials, extension storage, and cryptocurrency wallet data; the theft of live session cookies can enable attackers to bypass MFA by hijacking authenticated sessions.
Jun 29, 2026
Threat actors used an AI-generated typosquatting site impersonating a Brazilian bank to deliver **SmartRAT**, a PowerShell-based banking trojan built for financial theft. Victims were funneled through a fake Cloudflare CAPTCHA and then a fullscreen fake BSOD/system recovery page that pressured them to paste and run a malicious PowerShell command, which fetched additional payload stages from attacker-controlled infrastructure. Researchers linked the campaign to delivery from `64.95.13.238`, command-and-control at `windowsupdate-cdn[.]com`, and a fallback IP of `162.141.111.227`. Once installed, SmartRAT established encrypted raw TCP communications over port `51888`, persisted through scheduled tasks, registry Run keys, and optionally a Windows service named **MicrosoftEdgeUpdateCore**, and could run with elevated privileges while still interacting with the user session. The malware monitored Brazilian banking, payment, and cryptocurrency windows, used keylogging and fake bank-branded overlays to steal credentials, and supported QR-swap fraud by replacing on-screen banking QR codes with attacker-controlled images. It also provided full RAT capabilities including screen streaming, file exfiltration, clipboard manipulation, process and service listing, arbitrary PowerShell execution, and input freezing; researchers additionally found the web-based SmartRAT control panel had a critical authentication weakness, relying on client-side `localStorage` checks without server-side validation.
Jun 29, 2026
A **ClickFix**-style malware campaign has been observed using **fake CAPTCHA** pages on compromised websites to trick users into **manually executing** malicious commands, enabling initial access while evading controls that focus on downloaded files. In the reported activity, victims are prompted to copy a **PowerShell** command and run it themselves; the script then downloads additional stages from attacker infrastructure (including `91.92.240.219`), verifies user interaction by checking clipboard activity, and proceeds through a multi-stage infection chain. The payload is an **information stealer** targeting data from **25+ web browsers**, cryptocurrency wallets (e.g., *MetaMask*), and enterprise VPN configurations, with checks for virtualized environments and security tooling prior to exfiltration. Separately reported threat activity in the same time window includes **UnsolicitedBooker** targeting Central Asian telecoms with phishing-delivered backdoors (**LuciDoor** and **MarsSnake**) and **APT28** running *Operation MacroMaze*, which uses weaponized Office documents and `INCLUDEPICTURE` fields pointing to `webhook[.]site` URLs as a tracking mechanism and to support follow-on macro-based payload delivery. A video-style weekly briefing also mentions an evolution of ClickFix where an initial command uses `nslookup` and parses the response for execution, but it is a multi-topic roundup rather than a primary source on the fake-CAPTCHA infostealer campaign; a malware newsletter roundup is likewise a link collection and does not add specific, corroborating details about the ClickFix CAPTCHA infostealer operation.
Jun 29, 2026