REF6045 is an operator-assisted Mexican banking fraud operation that uses fake CAPTCHA pages to trick victims into running a command that installs the SCMBANKER PowerShell toolkit. SCMBANKER enables session monitoring, vishing overlays, browser redirects, clipboard manipulation, Remote Utilities deployment, and other controls across Mexico’s financial ecosystem, while exposed infrastructure, open directories, and script artifacts reveal weak OPSEC and likely AI-assisted development. #REF6045 #SCMBANKER #RemoteUtilities #FakeUpdate #ElasticSecurityLabs

A malware URL scanner has become an essential security tool as cybercriminals continue to refine their phishing tactics and malware delivery methods. Researchers recently uncovered a sophis...

A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using ClickFix lures. The activity cluster, tracked by Elastic Security Labs under the moniker REF6045, involves infecting victims through fake CAPTCHA verification pages that deceive them into running a malicious command that installs a PowerShell toolkit dubbed

Simple Steps To Eliminate Malicious Application SCMBANKER is a banking malware designed to steal money and personal information from people, mainly in Mexico. It is much more than a simple virus because it combines many tools into one fraud system. Victims are usually infected through fake CAPTCHA pages that pretend to verify they are human. In order to remove SCMBANKER Trojan, you should run a complete system scan with a reputable antivirus program and remove any detected threats.

Fake Google verification pages spread SCMBANKER malware, targeting Mexican bank customers with ClickFix tricks and banking fraud.

SCMBANKER watches banking windows, captures screenshots, hijacks CLABE and card numbers, and can deploy Remote Utilities for hands-on access.

A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using ClickFix lures. The activity cluster, tracked by Elastic Security Labs under the moniker REF6045, involves infecting victims through fake CAPTCHA verification pages that deceive them into running a malicious command that installs a PowerShell toolkit dubbed

On June 18, 2026, security analysts detected a host downloading suspicious PowerShell scripts from an open directory. At a glance Actor or Group: REF6045 (suspected) Activity Type: Phishing, vishing, and malware deployment Targets or Victims: Mexican retail banks, fintechs, and crypto platforms Scale: Unconfirmed number of active victims Jurisdiction or Law-Enforcement Status: Private sector research disclosure Source: Elastic Security Labs…

REF6045として追跡されているメキシコの銀行詐欺キャンペーンが、金融データ窃取において極めて手動色の強い手法を採用していることが分かりました。 自動化されたスクリプトに頼るのではなく、人間のオペレーターがSCMBANKERというPowerShellツールキットを使い、感染したマシンを積極的に監視するのです。攻撃は

REF6045として追跡されている、人間が操作するメキシコの銀行詐欺キャンペーンで、独自開発のPowerShellツールキット「SCMBANKER」を使用し、コモディティ化されたクリック詐欺の誘導手口を、オペレーターが介在するアカウント乗っ取りや送金先変更へと発展させている実態が確認されました。 この作戦は、偽のCA

SCMBANKER watches banking windows, captures screenshots, hijacks CLABE and card numbers, and can deploy Remote Utilities for hands-on access.

A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using ClickFix lures.

specifically created to target Mexico's financial sector read more about SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users