As reported by Elastic Security Labs, a financially motivated threat operation tracked as REF6045 is actively running a coordinated banking fraud toolkit — dubbed SCMBANKER — against customers of Mexican banks, fintech platforms, payment processors, and cryptocurrency exchanges. This is not a spray-and-pray phishing campaign. It is a disciplined, operator-assisted fraud operation with live human involvement at the point of cash-out, and that distinction should significantly raise defenders' concern levels.

Threat Alert: As reported by Elastic Security Labs, a financially motivated threat operation tracked as REF6045 is actively running a coordinated banking fraud toolkit — dubbed SCMBANKER — against customers of Mexican banks, fintech platforms, payment processors, and cryptocurrency exchanges.

Why This Threat Model Is Different

The use of ClickFix as an initial access vector deserves particular attention. ClickFix is a social engineering technique that weaponizes users' instinct to self-diagnose — presenting fake error messages or CAPTCHA prompts that instruct victims to manually execute malicious commands. It bypasses many traditional endpoint controls because the user becomes the execution mechanism. When you combine this with a real-time, operator-assisted fraud backend, you have a threat that is simultaneously stealthy at the endpoint layer and highly effective at the financial fraud layer.

What makes REF6045 particularly dangerous is the human-in-the-loop component during the cash-out phase. Automated fraud is increasingly caught by behavioral analytics on the banking side. Operator-assisted fraud — where a live threat actor monitors sessions, adapts to MFA challenges, and guides transactions in real time — is substantially harder for fraud detection systems to flag as anomalous, because the session may closely mimic legitimate user behavior patterns.

Who Is at Risk

Why This Threat Model Is Different
End users of Mexican retail banks, neobanks, and fintech apps who may encounter ClickFix lures via malvertising, phishing emails, or compromised sites
Cryptocurrency exchange customers operating in Latin American markets, where regulatory oversight of fraud response can be slower
Payment processor employees who may be targeted for credential access to higher-value systems
Security teams at financial institutions who may be under-indexing on Latin American threat actor activity compared to Eastern European or North Korean groups

The Broader Implication: Latin America as an Emerging Fraud Frontier

The cybersecurity community has historically concentrated fraud-focused threat intelligence on Brazilian-origin banking trojans (Grandoreiro, Mekotio, etc.) or Eastern European groups. REF6045 signals that Mexico and the broader Spanish-speaking LatAm region are maturing as both targets and operational bases for sophisticated fraud ecosystems. Financial institutions expanding digital services into these markets without commensurate fraud detection investment are accepting asymmetric risk.

There is also a supply chain implication here. Fintech platforms and payment processors that aggregate banking relationships across multiple institutions represent high-value targets — a single compromised fintech session may expose accounts across several partner banks, multiplying the fraud opportunity without proportionally multiplying the attacker's effort.

Shield53 Perspective: Operator-assisted fraud operations represent the convergence of social engineering sophistication and live financial crime expertise. Defenders cannot rely solely on malware detection — they must build behavioral fraud analytics capable of identifying operator-pattern anomalies during authenticated sessions.

Shield53 Recommendations

For Financial Institutions and Fintechs

  • Harden against ClickFix delivery: Deploy browser-level controls (e.g., disabling RunDLL32, PowerShell, and cmd.exe invocation from browser processes) via endpoint policy. Consider Windows Attack Surface Reduction (ASR) rules that block Office and browser child process execution.
  • Implement session behavioral analytics: Operator-assisted fraud will mimic legitimate navigation but often shows micro-behavioral anomalies — unusual typing cadence, rapid form completion, non-human mouse movement patterns. Invest in session replay and behavioral biometrics if not already deployed.
  • Transaction velocity and out-of-band verification: For high-value or first-time-recipient transactions, implement mandatory out-of-band confirmation (phone call, not SMS which can be SIM-swapped) as an additional friction layer.
  • Threat intel enrichment: Integrate the Elastic Security Labs indicators from REF6045 into your SIEM and TIP immediately. Monitor for SCMBANKER-associated TTPs across your environment.

For Security Operations Teams

  • Hunt for ClickFix execution patterns: PowerShell or cmd.exe spawned from user-interactive processes following browser activity, particularly with base64-encoded payloads or mshta.exe invocations.
  • Review EDR telemetry for clipboard manipulation events (a common ClickFix delivery mechanism where malicious commands are pasted rather than typed).
  • Monitor for unexpected LOLBin usage (certutil, bitsadmin, msiexec) in user-context processes on machines with recent browser activity.

For End Users and Security Awareness Programs

  • Train users to recognize ClickFix lures: legitimate websites and applications will never ask you to open a command prompt or PowerShell window and paste commands.
  • Reinforce that CAPTCHA prompts should never require local code execution — this is always a social engineering attempt.

The REF6045/SCMBANKER operation is a reminder that fraud operations are not slowing down — they are professionalizing. Security teams protecting financial services customers in Latin American markets should treat this as an active, ongoing threat requiring immediate detection rule deployment and fraud team briefing.