ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

### Executive summary: Elastic Security Labs documents REF6045, a human-operated Mexican banking fraud campaign that uses fake CAPTCHA pages to trick victims into running a staged PowerShell toolkit (SCMBANKER). The toolkit enables banking-session monitoring, screenshot capture, vishing lock screens to prompt live phone scams, clipboard replacement of bank/payment details, active browser redirects for phishing, and silent installation of a commercial Remote Utilities RAT; the report includes execution details, persistence, C2 behavior, extensive IoCs (IPs, domains, URLs, file hashes), and notes operator OPSEC failures and likely AI-assisted code generation.