Loading story…
The REF6045 banking-fraud operation is targeting Mexico’s financial ecosystem with ClickFix-style fake CAPTCHA pages that deceive victims into running commands that install the SCMBANKER PowerShell toolkit. The campaign targets banks, fintechs, payment processors, cryptocurrency and investment platforms, the SAT tax authority, and telecommunications services; researchers found components dating to at least October 2025.
SCMBANKER monitors banking activity, captures screenshots, intercepts CLABE and payment-card data copied to the clipboard, redirects browsers to phishing pages, and displays fake bank-warning overlays to support vishing. The toolkit can also deploy Remote Utilities Host for persistent remote access. Exposed directories, archived web content, and unauthenticated C2 configuration editors revealed shared SCM-branded infrastructure and targeting configurations; Elastic assessed that the crude but operational PowerShell tooling was likely substantially generated with LLM assistance before light obfuscation.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Elastic telemetry detected suspicious bitsadmin downloads associated with REF6045 activity.
Elastic Security Labs observed the REF6045 operator-assisted banking-fraud operation targeting Mexico's financial ecosystem with ClickFix lures and the SCMBANKER PowerShell toolkit.
VirusTotal evidence indicates that earlier versions of SCMBANKER toolkit components had been in use since at least October 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 68 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A fraud operation tracked as **REF6045** is targeting users across Mexico’s financial ecosystem with fake CAPTCHA **ClickFix** lures that trick victims into pasting a malicious command into the Windows Run dialog. The multi-stage infection chain installs a PowerShell-based toolkit called **SCMBANKER**, establishes persistence, and can optionally deploy **Remote Utilities Host** for full remote access. Researchers said the campaign has targeted banks, fintechs, payment processors, cryptocurrency exchanges, investment platforms, tax services, and telecom providers, and has likely been active since at least October 2025. Once installed, SCMBANKER monitors banking sessions, captures screenshots and keystrokes, redirects browsers to phishing pages, displays fake bank warning overlays to push victims into vishing calls, and hijacks clipboard data including **CLABE** and payment card numbers. Elastic Security Labs said an operational security failure exposed parts of the attackers’ infrastructure, including open directories, a leaked web-root archive, and an unauthenticated file editor tied to `68.211.161[.]46`, allowing investigators to recover extensive tooling. The recovered code also showed strong signs of **AI-assisted development**, likely drafted in Spanish and later manually obfuscated.
Jul 10, 2026
Researchers reported multiple **ClickFix** campaigns using fake CAPTCHA or reCAPTCHA prompts to trick users into manually running malicious commands, with payloads tailored by platform and victim profile. On Windows, one campaign delivered a modular NodeJS-based RAT and infostealer through a malicious MSI installer, loading key capabilities only in memory after command-and-control was established and using `gRPC` over Tor for persistent communications. An operational security failure exposed the malware’s backend protocol definitions and admin panel API, revealing a malware-as-a-service operation with multi-operator support, Telegram alerts, automation rules, and cryptocurrency wallet tracking. The malware also fingerprinted victims extensively and established persistence through the Windows Run registry key as **LogicOptimizer**. A separate ClickFix chain attributed with high confidence to **Grandoreiro** targeted users of eight Brazilian banks by luring victims through a fake reCAPTCHA page and launching a malicious PowerShell sequence that sideloaded a Delphi banking trojan with legitimate GoToMeeting and Nero binaries. The malware deployed banking overlays, intercepted **PIX** QR-code payments, added Microsoft Defender exclusions, and stole credentials, device information, signatures, and payment confirmation codes. Netskope also documented a macOS variant that used AppleScript and a persistent fake password dialog to harvest Keychain data, browser cookies, saved credentials, extension storage, and cryptocurrency wallet data; the theft of live session cookies can enable attackers to bypass MFA by hijacking authenticated sessions.
Jun 29, 2026
Threat actors used an AI-generated typosquatting site impersonating a Brazilian bank to deliver **SmartRAT**, a PowerShell-based banking trojan built for financial theft. Victims were funneled through a fake Cloudflare CAPTCHA and then a fullscreen fake BSOD/system recovery page that pressured them to paste and run a malicious PowerShell command, which fetched additional payload stages from attacker-controlled infrastructure. Researchers linked the campaign to delivery from `64.95.13.238`, command-and-control at `windowsupdate-cdn[.]com`, and a fallback IP of `162.141.111.227`. Once installed, SmartRAT established encrypted raw TCP communications over port `51888`, persisted through scheduled tasks, registry Run keys, and optionally a Windows service named **MicrosoftEdgeUpdateCore**, and could run with elevated privileges while still interacting with the user session. The malware monitored Brazilian banking, payment, and cryptocurrency windows, used keylogging and fake bank-branded overlays to steal credentials, and supported QR-swap fraud by replacing on-screen banking QR codes with attacker-controlled images. It also provided full RAT capabilities including screen streaming, file exfiltration, clipboard manipulation, process and service listing, arbitrary PowerShell execution, and input freezing; researchers additionally found the web-based SmartRAT control panel had a critical authentication weakness, relying on client-side `localStorage` checks without server-side validation.
Jun 29, 2026