Executive Summary
The threat actor tracked as REF6045 is currently targeting customers of Mexican banks, fintechs, and cryptocurrency exchanges. The campaign utilizes 'ClickFix' lures, where victims are deceived by fake CAPTCHA pages into executing a malicious PowerShell command. This command installs SCMBANKER, a specialized toolkit that likely leverages large language models (LLMs) for its development.
The attack chain involves significant psychological manipulation, including the use of a fake Windows Update screen to distract victims while the malware installs in the background. Once active, SCMBANKER provides attackers with extensive control, including banking session monitoring, automated clipboard hijacking for account number replacement, and the ability to deploy commercial remote-access tools like Remote Utilities.
This campaign represents a persistent threat to the Mexican financial sector. Despite technical indicators of 'shoddy craftsmanship' and AI-assisted coding, the operation is highly effective, allowing operators to live-monitor victims and engage in manual 'hands-on' fraud, such as vishing and browser redirection, when high-value targets are identified.