ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

A Mexican banking fraud campaign, identified as REF6045, is being actively managed by human operators who monitor infected systems and direct malicious activities. The initial infection vector involves deceptive CAPTCHA pages that trick users into executing a command, which then installs the SCMBANKER PowerShell toolkit. This toolkit, with components dating back to at least October 2025, provides operators with a comprehensive suite of tools for financial fraud.

Once SCMBANKER is deployed, operators can observe when a victim initiates a banking session. They can then lock the victim's screen with a fake bank warning, push the user towards live phone support, redirect their web browser, or even replace copied bank account numbers with their own. For complete control, the operation can also deploy commercial remote access tools.

Key aspects of the REF6045 operation include the adaptation of ClickFix delivery methods to facilitate operator-assisted banking fraud. Fake verification pages are used to stage the SCMBANKER toolkit, which offers a full fraud workflow. This includes monitoring banking activity, capturing screenshots, presenting vishing overlays, executing phishing redirects, manipulating clipboard data, and installing remote access tools.

The SCMBANKER toolkit specifically targets Mexico's financial ecosystem, encompassing retail and business banking portals, fintech companies, payment processors, cryptocurrency exchanges, investment platforms, tax authorities (SAT), and telecommunications services. The operation's tooling and targeting logic were exposed due to operator security oversights, such as open directories, a leaked web archive, and an unauthenticated file editor.

Analysis of the scripts revealed a significant number of AI-generated artifacts, suggesting the operator leveraged large language models (LLMs) in their development. Elastic Security Labs detected the operation on June 18, 2026, when telemetry indicated a host downloading suspicious PowerShell scripts from an exposed directory. Retrieving an archive from the same server provided a more complete view of the operation's web root.

The infection chain begins with a ClickFix fake CAPTCHA page, which presents an image challenge before instructing the victim to run a command. This command downloads a batch script disguised as a validation file. The script then initiates a series of malicious actions, including launching a fake Windows Update screen in Microsoft Edge's kiosk mode to distract the victim.

To ensure elevated privileges, the malware checks for administrator rights and, if absent, prompts the user with a social-engineered message to update their system, repeatedly relaunching itself with administrative privileges until the User Account Control (UAC) prompt is accepted. Once elevated, the mouse cursor is confined to a tiny area on the screen, preventing user interaction and further facilitating the background download of the SCMBANKER toolkit.

Malicious scripts and binaries are downloaded individually via bitsadmin from an exposed file server to a public directory. Persistence is established through the Windows Registry's Run key and the Startup folder, ensuring the toolkit launches on subsequent logons. The operation also includes a mechanism to force a reboot, which then triggers the persistence routines.

The SCMBANKER toolkit's master launcher is a VBScript that initiates various modules in parallel. These modules handle tasks such as process rotation, delayed execution of monitoring and redirect scripts, C2 communication, remote access tool installation, clipboard hijacking for account numbers, and arbitrary PowerShell command execution. An invisible cursor utility is also deployed to further hinder user interaction.