ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

Elastic Security Labs describes REF6045 (SCMBANKER), an operator-driven Mexican banking fraud campaign that uses fake CAPTCHA ClickFix lures to convince victims to run a command that stages a PowerShell toolkit; the toolkit provides banking-session monitoring, screenshot capture, vishing lock-screen overlays, clipboard CLABE/card-number hijacking, phishing redirects, and on-demand silent installation of Remote Utilities RAT, and the report enumerates extensive IOCs (IPs, domains, URLs, and SHA-256s) and highlights operator OPSEC failures and signs of AI-assisted code generation.