SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users

A new banking fraudulent operation is targeting customers of Mexican banks, fintech, payment processors, and cryptocurrency exchanges using ClickFix lures. The activity cluster, tracked by Elastic Security Labs under the moniker REF6045, involves infecting victims through fake CAPTCHA verification pages that deceive them into running a malicious command that installs a PowerShell toolkit dubbed

The reported activity is a banking-fraud campaign targeting customers of Mexican banks, fintechs, payment processors, and cryptocurrency exchanges via fake CAPTCHA/ClickFix lures that induce victims to run a malicious command installing the SCMBANKER toolkit. The toolkit supports banking-session monitoring, screenshot capture, phishing redirects, clipboard manipulation, vishing overlays, and remote-access installation. RealGround relevance is indirect: the incident is not an AI-system compromise itself, but it does involve financially focused fraud operations that may leverage an LLM in tooling, making fintech security controls and agent/business-logic review relevant.