SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users

A new malware campaign is targeting Mexican banking users, including those of fintech, payment processors, and cryptocurrency exchanges. The campaign uses ClickFix lures to infect victims, who are deceived into running a malicious command through fake CAPTCHA verification pages. This command installs a PowerShell toolkit, which is part of an activity cluster tracked as REF6045 by Elastic Security Labs. The toolkit is associated with the SCMBANKER malware. The malware operation appears to be focused on committing banking fraud. Elastic Security Labs is monitoring the activity cluster.