# SCMBANKER Malware Campaign Exploits ClickFix Social Engineering to Target Latin American Financial Institutions


A sophisticated malware operation is actively targeting customers of Mexican banks, fintech platforms, payment processors, and cryptocurrency exchanges through social engineering attacks leveraging fake CAPTCHA verification pages. Security researchers at Elastic Security Labs have tracked the activity cluster under the designation REF6045, identifying it as a coordinated campaign distributing banking malware with PayPal credential-stealing capabilities and extensive command-and-control functionality.


The campaign represents a notable escalation in targeted financial fraud within Latin America, combining established social engineering tactics with region-specific targeting to deceive users into executing malicious code that establishes persistent system access.


## The Threat


The SCMBANKER malware family, the primary payload in this operation, is being distributed through "ClickFix" lures—a social engineering technique that presents victims with fake browser security warnings or verification prompts designed to appear legitimate.


Attack Flow:

  • Victims are directed to malicious web pages impersonating legitimate banking security verification interfaces
  • The fake pages display urgent CAPTCHA-style verification challenges, claiming the user's account or device has been flagged for security purposes
  • Users clicking on the prompt are instructed to execute a command or download a file
  • The execution delivers a PowerShell toolkit that silently installs SCMBANKER and associated malicious components
  • Once installed, the malware begins reconnaissance and credential harvesting operations

    • Key Capabilities Identified:

  • PayPal credential theft and man-in-the-browser injection
  • Banking session hijacking and transaction interception
  • Persistence mechanisms ensuring malware survival across reboots
  • Remote command-and-control capabilities for operator interaction
  • Screen capture and keystroke logging functionality

    • ## Technical Details


    Elastic Security Labs' analysis reveals that SCMBANKER leverages PowerShell as its initial execution vector, taking advantage of legitimate Windows scripting capabilities to bypass traditional endpoint detection.


    Attack Mechanism:


    The initial payload is a PowerShell script that performs the following sequence:

    1. Execution Policy Bypass – Circumvents Windows PowerShell execution restrictions

    2. Malware Installation – Deploys SCMBANKER and supporting components to system directories

    3. Persistence Establishment – Creates scheduled tasks or registry entries ensuring automatic startup

    4. Communication Initialization – Establishes contact with attacker-controlled command servers

    5. Reconnaissance – Collects system information, installed browsers, and active sessions


    The malware specifically targets browser processes to inject code into payment-related sessions, allowing attackers to intercept credentials in real-time as users authenticate to banking platforms.


    Exploitation Vector:


    ClickFix campaigns have historically achieved high success rates due to their psychological manipulation of security concerns. By presenting warnings that appear to originate from legitimate sources (browsers, banks, or payment platforms), attackers exploit user expectations around system security prompts—a phenomenon security researchers call "security fatigue," where users comply with urgent-appearing requests without verification.


    ## Background and Context


    Mexican financial institutions have faced increasing targeting from organized cybercriminal groups over the past 24 months, with multiple documented campaigns targeting specific banks and fintech platforms operating in the region.


    Regional Financial Landscape:


    Mexico's banking sector includes established institutions (Banco Santander Mexico, BBVA México, Citibanamex) alongside rapidly growing fintech platforms and cryptocurrency exchanges serving both retail and business customers. The region's financial digitization has accelerated adoption of mobile banking, remittance services, and cryptocurrency transactions—all targets of opportunity for cybercriminals.


    Cryptocurrency as a Secondary Target:


    The inclusion of cryptocurrency exchanges in this campaign is significant. Mexican cryptocurrency users, particularly those engaged in informal remittance transfers, have become attractive targets for malware campaigns. Unlike traditional banking transactions, which offer fraud reversal protections, cryptocurrency transfers are largely irreversible once executed—making stolen credentials particularly valuable to attackers.


    Timeline and Attribution:


    REF6045 activity has been observed for several months, suggesting operational continuity and successful monetization. The technical sophistication and region-specific targeting indicate organized cybercriminal operations rather than opportunistic attackers.


    ## Implications for Organizations


    For Financial Institutions:


    Banking and fintech platforms should recognize that their customers are under active, sophisticated attack. Endpoint detection at the customer level is insufficient; institutions must implement anomalous transaction detection, adaptive authentication, and out-of-band verification for high-risk transactions.


    For End Users:


    Individual users face direct credential theft risk. Once SCMBANKER achieves persistence on a system, attackers can monitor all banking activity, intercept multi-factor authentication codes, and execute unauthorized transactions.


    For Payment Processors:


    Payment processors handling both traditional and cryptocurrency transactions must monitor for unusual activity patterns that could indicate compromised customer endpoints. Legitimate processors should ensure their security warnings cannot be spoofed—a key vulnerability in current phishing approaches.


    ## Recommendations


    For Financial Organizations:


  • Implement Account Takeover Detection – Deploy behavioral analytics to identify impossible travel scenarios, unusual geographic login patterns, and transaction velocity anomalies
  • Enforce Hardware-Based Authentication – For high-value customers, require security keys or hardware tokens resistant to remote interception
  • Customer Education Programs – Conduct targeted awareness campaigns specific to regional attack trends, emphasizing that legitimate institutions will never request command execution or downloads
  • Endpoint Monitoring – Partner with security vendors to offer optional endpoint threat detection to customers, particularly business customers at elevated risk

    • For End Users:


  • Verify Security Warnings – Never execute commands or download files prompted by browser warnings; instead, directly navigate to official banking websites
  • Keep Systems Patched – Ensure Windows updates and security patches are current; PowerShell execution restrictions are more difficult to bypass on patched systems
  • Monitor Financial Accounts – Review recent transactions regularly; set up alerts for payment method changes
  • Use Hardware Security Keys – For critical financial accounts, enable security key-based authentication where available

    • For Security Teams:


  • Monitor for indicators of compromise including unexpected PowerShell execution, ClickFix-related domain access, and credential manager access patterns
  • Hunt for suspicious scheduled tasks and unusual registry modifications associated with malware persistence
  • Investigate any instances of browser credential injection or man-in-the-browser activity

    • ---


    ## HackWire Analysis


    The SCMBANKER campaign demonstrates a critical shift in how financial malware operators approach targeting in developing markets: rather than attempting broad exploitation of known vulnerabilities, REF6045 operators are concentrating resources on high-confidence social engineering that leverages human psychology and reasonable user skepticism against itself.


    The ClickFix vector is particularly insidious because it exploits a fundamental security principle—that users *should* respond to browser and system security warnings. By presenting warnings that are indistinguishable from legitimate warnings, operators have essentially weaponized user compliance with security practices.


    What distinguishes this campaign from historical phishing is the region-specific operational focus. Unlike spray-and-pray banking trojans from a decade ago, REF6045 appears to be specifically researching Mexican financial institutions, locales, and common user behaviors. The simultaneous targeting of banks, fintech, payment processors, and cryptocurrency exchanges suggests attackers understand Mexico's emerging digital financial ecosystem and are systematically compromising it.


    The broader implication: Latin America has become a priority target region for organized financial cybercrime, and attacks are becoming increasingly sophisticated and region-aware. U.S. and European institutions have spent a decade building institutional defenses against financial malware; Latin American organizations are compressed into a shorter timeline to achieve equivalent security maturity while facing equally sophisticated adversaries.


    The monetization model (credential theft, transaction interception, cryptocurrency transfers) is straightforward and reliable. Unlike ransomware operators who depend on organizational ransom payment decisions, financial malware operators simply drain customer accounts. This makes SCMBANKER and similar operations inherently lower-risk for criminal operators—and therefore likely to persist and grow.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)