SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users

A sophisticated new malware campaign targeting Mexican financial institutions has emerged, employing deceptive "ClickFix" lures to compromise banking customers and siphon sensitive information. The threat represents a significant escalation in banking fraud techniques, specifically designed to bypass traditional security awareness training by exploiting user trust in familiar web interfaces.

The campaign, designated as REF6045 by Elastic Security Labs, delivers a PowerShell-based malware toolkit through convincingly crafted fake CAPTCHA verification pages. When unsuspecting customers of Mexican banks, fintech companies, payment processors, or cryptocurrency exchanges attempt to verify their humanity, they're instead presented with instructions to execute a malicious PowerShell command. Once initiated, this command installs the SCMBANKER malware, giving attackers persistent access to infected systems and the ability to harvest credentials, financial information, and other sensitive data.

What makes this attack particularly concerning is its targeted nature. Rather than casting a wide net, the threat actors are focusing exclusively on Mexican financial sector users, suggesting a well-planned operation with specific objectives. The use of ClickFix lures represents an evolution in social engineering tactics, moving beyond basic phishing emails to interactive web experiences that closely mimic legitimate verification processes.

Security teams need to recognize that this threat operates at the intersection of technical sophistication and psychological manipulation. The PowerShell-based nature of the malware makes it particularly challenging to detect using traditional signature-based antivirus solutions, as PowerShell is a legitimate administrative tool