REF6045 Uses ClickFix and SCMBANKER for Mexican Banking Fraud
Summary
Elastic researchers describe REF6045, an operator-assisted banking fraud operation using fake CAPTCHA pages to install SCMBANKER, a PowerShell toolkit that monitors banking sessions and supports phishing, payment redirection and remote access.
Key points
- Fake CAPTCHA pages instruct victims to run a command that downloads and executes a batch script, which installs the toolkit.
- The installer displays a fake Windows update, repeatedly requests administrator privileges and establishes persistence through a registry Run key and Startup folder copies.
- A banking monitor checks window titles for financial services and can trigger alerts and repeated screenshots.
- Operators can direct selected victims to phishing pages or display fake bank warnings that prompt phone calls.
- Clipboard modules can replace copied Mexican CLABE account numbers and card numbers with attacker-controlled values.
- The toolkit can silently install and configure Remote Utilities Host for persistent interactive access.
- Open directories, an exposed web-root archive and an unauthenticated editor helped researchers examine the operation; script artifacts suggest AI-assisted development.
Article Details
- Attack Vectors
- ClickFix fake CAPTCHA pages induce victims to run a command that downloads and executes a batch installer.
- SCMBANKER monitors banking windows and enables operator-triggered phishing redirects, fake bank warnings and payment-detail substitution.
- The toolkit can silently install and configure Remote Utilities Host for operator access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bancaporinternetbbmx[.]online | Observed banking phishing destination used by the redirect module. |
| DOMAIN | gestionmontelavaria2026[.]online | C2 domain extracted from hosted SCMBANKER scripts. |
| DOMAIN | monteviral2026[.]duckdns[.]org | ClickFix lure and toolkit file-hosting hostname. |
| DOMAIN | negratomasa2026[.]online | SCMBANKER C2 and operator configuration domain. |
| DOMAIN | osogransd[.]online | ClickFix lure and toolkit file-hosting domain. |
| DOMAIN | ratonvaquero2026[.]online | ClickFix lure and toolkit file-hosting domain. |
| DOMAIN | ssinvestigaciones[.]com | Domain identified as a ClickFix post-CAPTCHA tracking endpoint. |
| IPV4 | 185[.]242[.]246[.]169 | C2 server associated with a SCMBANKER infrastructure variant. |
| IPV4 | 216[.]250[.]112[.]100 | File server used to deliver a ClickFix validation payload. |
| IPV4 | 68[.]211[.]161[.]46 | ClickFix validation and toolkit file server. |
| SHA256 | 0ec9b518f84b6bdc0e843b89fa755522ec67db862414ad16bdcaa8c2be25485c | Hash of edifhjwe.ps1, the SCMBANKER self-updater. |
| SHA256 | 30ff24faad80184bb43660a8bd317df99a8d09d31bae3b446aaa876543f2620f | Hash of key.ps1, the toolkit's keylogging module. |
| SHA256 | 3d9015429d65276869ceb9c91f10d6474b1098042db75949c49b9f1682c1f3ae | Hash of remoto.ps1, the Remote Utilities configurator. |
| SHA256 | 4d9c160ebb44507b11f0e6421f691900284f25b5530a23d9fd50de0ae01663ca | Hash of mensaje.ps1, the hard-lock vishing overlay. |
| SHA256 | 526287a40aad1b218228cdd1f459ad3b93f858585048347644d597c6ab19515a | Hash of cliente.ps1, the C2 beacon. |
| SHA256 | 554f1aefeb698995501751328c2f9fe93f02a680679fba3dd15f1ed93d46bf1b | Hash of the validation.txt first-stage batch payload. |
| SHA256 | 566f4bfdfea54129b8528d50cae187a9030e2f2787749add4b0db22ac35ea581 | Hash of screen2.ps1, the screenshot module. |
| SHA256 | 5bc85b604eb37ffa1e67c57f4744b55ef876a1ab442e2a2440550ef0922aeec7 | Hash of correr.ps1, the arbitrary PowerShell executor. |
| SHA256 | 685d29ce8a550feb3a9e1d1c5926ec5e927615cf34aab62c108a812a1eb6737c | Hash of jujuzkt.ps1, the banking activity monitor. |
| SHA256 | 6c8ba7127a83431432e85946976c18bb3f3e9bf9def68aae572cd1d9d73604c7 | Hash of avs.ps1, the Remote Utilities downloader. |
| SHA256 | 6dcd7fdd5e088d98d861cbd1cb74a7b83ae5508f4dbb617413bcbe7fbc8a82e2 | Hash of mensaje1.ps1, the vishing dispatcher. |
| SHA256 | 70140aa236d630a7d5ed08be3dafcccea9a8b0eec6dadf8c1cf1b96d8f608609 | Hash of clip2.ps1, the card-number clipboard hijacker. |
| SHA256 | 8c87ea94401fa97d3743a87604e088d1a29c7b06cf9673623941a42da68452a6 | Hash of jujuzkt2.ps1, the phishing redirect module. |
| SHA256 | b30cb0aa977aacdab94d2ef503186c8f0b2fc10d7cf0d7c7c0ada70c127dc7e8 | Hash of the exposed zkt.zip operation web-root archive. |
| SHA256 | eea08fbf3720d638af1d313d3ce369708b77d7891379d5c5871dd7f36667ed0c | Hash of clip.ps1, the account-number clipboard hijacker. |
| SHA256 | ff3555154e91e42490cc722b6c7f3c4c91654b7ef53a35d0719ffb89accf1b27 | Hash of run.vbs, the SCMBANKER master launcher. |
| URL | hxxp[:]//68[.]211[.]161[.]46/driver.html?off | Observed vishing page linking to a Remote Utilities payload. |
| URL | hxxp[:]//68[.]211[.]161[.]46/validation.txt | First-stage batch payload fetched by ClickFix commands. |
| URL | hxxps[:]//gestionmontelavaria2026[.]online/dashboard2/recData.php | C2 endpoint extracted from a hosted toolkit variant. |
| URL | hxxps[:]//negratomasa2026[.]online/dashboard2/recData.php | SCMBANKER beacon endpoint receiving victim profiles and returning operator commands. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe keylogging script Base64-encodes Win32 API names, although comments disclose their decoded values.T1056.001 · KeyloggingThe toolkit includes key.ps1 and a rotator for keylogging, although its launch path in the banking monitor is commented out.T1057 · Process DiscoveryThe banking monitor inspects visible window titles and associated processes for target keywords.T1059.001 · PowerShellSCMBANKER uses PowerShell scripts for monitoring, staging, updates and operator-directed execution.T1059.003 · Windows Command ShellThe ClickFix command pipes the downloaded validation.txt batch script into cmd.exe.T1059.005 · Visual BasicThe run.vbs launcher starts toolkit modules through WScript.Shell.T1105 · Ingress Tool TransferThe first-stage script downloads toolkit components from an open file directory using bitsadmin.T1112 · Modify RegistryThe toolkit imports Remote Utilities configuration into the registry and deletes its uninstall entry.T1113 · Screen CaptureA banking-window match triggers repeated desktop screenshots uploaded to the operator's server.T1115 · Clipboard DataClipboard modules inspect copied account and card numbers and replace matching values with attacker-controlled alternatives.T1204.002 · Malicious FileFake CAPTCHA instructions persuade victims to run a command that retrieves and executes the first-stage payload.T1219 · Remote Access ToolsThe operator can silently install and configure Remote Utilities Host for persistent interactive access.T1547.001 · Registry Run Keys / Startup FolderA Registry Run key and Startup folder copies launch run.vbs at logon.T1548.002 · Bypass User Account ControlThe installer repeatedly requests elevation through RunAs and pressures the victim to approve the UAC prompt.T1564.003 · Hidden WindowThe launcher starts PowerShell modules with a hidden window style.
Threat Actors
Malware
Products
Countries
Industries
business bankingTargets include Mexico’s retail banks, business banking portals, fintechs, payment processors, cryptocurrency exchanges, investment platforms, SAT, and telecom services.cryptocurrency exchangesTargets include Mexico’s retail banks, business banking portals, fintechs, payment processors, cryptocurrency exchanges, investment platforms, SAT, and telecom services.fintechsTargets include Mexico’s retail banks, business banking portals, fintechs, payment processors, cryptocurrency exchanges, investment platforms, SAT, and telecom services.investment platformsTargets include Mexico’s retail banks, business banking portals, fintechs, payment processors, cryptocurrency exchanges, investment platforms, SAT, and telecom services.payment processorsTargets include Mexico’s retail banks, business banking portals, fintechs, payment processors, cryptocurrency exchanges, investment platforms, SAT, and telecom services.retail banksTargets include Mexico’s retail banks, business banking portals, fintechs, payment processors, cryptocurrency exchanges, investment platforms, SAT, and telecom services.telecom servicesTargets include Mexico’s retail banks, business banking portals, fintechs, payment processors, cryptocurrency exchanges, investment platforms, SAT, and telecom services.