AI-Generated Bank Lure Uses ClickFix to Deliver SmartRAT
Summary
ThreatLabz reports that attackers used an AI-generated page impersonating a Brazilian bank and a ClickFix lure to deliver SmartRAT, a PowerShell RAT capable of remote control and financial data theft.
Key points
- In March 2026, ThreatLabz observed typosquatting domains hosting malicious content created with AI-powered website tools.
- The campaign impersonated a Brazilian bank and used a fake CAPTCHA followed by a fullscreen fake system-recovery prompt to persuade victims to run a PowerShell command.
- The command downloaded and executed SmartRAT, a PowerShell-based RAT.
- SmartRAT supports encrypted C2, remote control, keylogging, banking overlays, QR-code interception, and persistence through scheduled tasks and a Windows service.
- ThreatLabz found an authentication-bypass flaw in the AI-generated C2 panel.
- The article lists fraudulent domains, C2 infrastructure, and file hashes as indicators of compromise.
Article Details
- Attack Vectors
- A fake webpage impersonating a Brazilian bank presents a fake CAPTCHA and fullscreen fake BSOD/system-recovery prompt to pressure victims into running a PowerShell command.
- The PowerShell command downloads and executes SmartRAT.
- SmartRAT supports encrypted C2 communications, remote control, credential theft, keylogging, banking overlays, QR-code interception, and persistence through scheduled tasks and a Windows service.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cartaobb[.]com | Domain listed as fraudulent in the campaign’s IOC table. |
| DOMAIN | crefisa[.]online | Fraudulent domain used to impersonate a Brazilian bank. |
| DOMAIN | vfsgloball[.]net | Domain listed as fraudulent in the campaign’s IOC table. |
| DOMAIN | windowsupdate-cdn[.]com | C2 domain for the campaign. |
| IPV4 | 162[.]141[.]111[.]227 | C2 IP address for the campaign. |
| IPV4 | 64[.]95[.]13[.]238 | C2 IP address for the campaign. |
| MD5 | 297eb45f028d44d750297d2f932b9c91 | Hash listed for the st.txt campaign artifact. |
| MD5 | 3c72e1f37f115b00c3ad6ed31bacfe8a | Hash of a PowerShell RAT artifact. |
| MD5 | 6bf4d4c62b5138ace281ce3d08297787 | Hash listed for the payload[.]php campaign artifact. |
| MD5 | b17ccdb5531555e43f082d6e77c07227 | Hash of a PowerShell RAT artifact. |
MITRE ATT&CK
T1053.005 · Scheduled TaskSmartRAT can persist through scheduled tasks.T1056.001 · KeyloggingSmartRAT supports keylogging to steal credentials.T1059.001 · PowerShellA PowerShell command downloads and executes the RAT.T1105 · Ingress Tool TransferThe PowerShell command downloads the RAT payload.T1204.004 · Malicious Copy and PasteThe ClickFix lure pressures victims to run a PowerShell command themselves.T1543.003 · Windows ServiceSmartRAT can persist as a Windows service.
Malware
Banana RATUpdate: Prior to our publication, Trend Micro wrote a blog post on this malware family that they dubbed Banana RAT with a different attack path.SmartRATcampaign impersonating a Brazilian bank to deliver a PowerShell-based RAT, which ThreatLabz named SmartRAT. SmartRAT supports encrypted C2 communications, remote control (screen/keyboard/mouse), credential theft
Vendors
Trend MicroUpdate: Prior to our publication, Trend Micro wrote a blog post on this malware family that they dubbed Banana RAT with a different attack path.ZscalerIn March 2026, Zscaler ThreatLabz observed multiple instances of typosquatting domains hosting malicious content generated with AI-powered website creation tools. Threat actors are leveraging website builders to create