SCMBANKER Malware Uses Click Fix Lures to Target Mexican Banking Users
Summary: Elastic Security Labs tracked a cluster called REF6045 that infects victims through fake CAPTCHA pages, tricking them into pasting a command into the Windows Run dialog that installs a PowerShell toolkit named SCMBANKER, with some components dating to October 2025. The toolkit targets Mexican banks, fintechs, payment processors, and crypto exchanges, and supports banking-session monitoring, screenshot capture, vishing overlays, phishing redirects, clipboard manipulation, and Remote Utilities installation, with researchers citing evidence that a large language model was used to develop much of the tooling.
Bottom line: The operator's own panels carry a live victim counter and labeled, tagged machines, so this is not a proof of concept - individual customers are being watched in real time and engaged only when the operator decides they are worth the effort.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026