threat-intel
SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users
High
Summary
A new banking fraud operation, tracked as REF6045, is targeting Mexican banks, fintech companies, and cryptocurrency exchanges using a malware toolset called SCMBANKER. The operation leverages fake CAPTCHA verification pages to trick users into running a PowerShell script that installs the malware, which then provides operators with extensive control over compromised systems, including banking session monitoring, screenshot capture, vishing overlays, and clipboard manipulation. Researchers attribute the toolset's development to the use of a large language model (LLM).
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data