SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users

A threat actor dubbed REF6045 is targeting Mexican banking and financial users through a malware toolkit named SCMBANKER, delivered via fake CAPTCHA lures. The attack uses social engineering to trick victims into executing a malicious command, leading to the installation of PowerShell-based malware that enables session monitoring, clipboard hijacking, browser redirection, and remote access. The operation shows signs of AI-assisted development, with poor operational security enabling researchers to recover infrastructure details. Victims are actively monitored and targeted based on financial activity, indicating ongoing live attacks.

AI-extracted · verify before operational use