As reported by The Hacker News, a newly tracked threat cluster designated REF6045 by Elastic Security Labs is actively targeting customers of Mexican banks, fintech platforms, payment processors, and cryptocurrency exchanges using a deceptive technique known as ClickFix — and the implications extend well beyond Mexico's borders.

Threat Alert: As reported by The Hacker News, a newly tracked threat cluster designated REF6045 by Elastic Security Labs is actively targeting customers of Mexican banks, fintech platforms, payment processors, and cryptocurrency exchanges using a deceptive technique known as ClickFix — and the implications extend well beyond Mexico's borders.

Why This Campaign Deserves Your Attention

ClickFix has rapidly evolved from a novelty social engineering technique into a reliable delivery mechanism for sophisticated threat actors. By presenting victims with convincing fake CAPTCHA verification pages — a UI element users have been conditioned to trust and interact with without hesitation — attackers bypass traditional endpoint defenses almost entirely. The victim becomes the delivery mechanism. No malicious attachment. No drive-by exploit. Just a human clicking "I'm not a robot" and unknowingly executing a PowerShell command that installs the SCMBANKER toolkit.

This is a critical distinction: the attack surface here is human cognition, not software vulnerabilities. That makes conventional patch management and endpoint scanning far less effective as a primary control.

Who Is at Risk

While the current campaign is geographically focused on Mexico, organizations and users in the following categories should treat this as a direct threat signal:

Why This Campaign Deserves Your Attention
Latin American financial institutions — the immediate target, but regional expansion is historically common with financially motivated threat actors
Cryptocurrency exchange users globally — crypto platforms are language-agnostic targets; infrastructure built for one region is easily repurposed
Fintech and payment processor employees — privileged access to payment rails makes these users high-value targets
Remote workers using personal or unmanaged devices — ClickFix campaigns exploit moments of distraction common in uncontrolled home environments
Security teams globally — ClickFix has appeared in multiple unrelated campaigns recently, suggesting threat actors are sharing or independently adopting the technique

The Broader ClickFix Trend Is Alarming

SCMBANKER is not an isolated incident. ClickFix-style lures have been observed in campaigns distributing infostealers, remote access trojans, and now banking-specific toolkits. What began as an occasional social engineering trick is now a preferred initial access methodology across multiple threat actor profiles — from commodity cybercrime to more organized groups. The pattern suggests defenders need to treat ClickFix not as a one-off tactic but as a persistent technique class requiring dedicated countermeasures.

"When an attack technique requires no exploit and no malware delivery chain beyond a user copying and pasting a command, the traditional security stack is largely irrelevant at the point of compromise. Defense must shift left — to awareness, policy, and pre-execution controls."

What Makes SCMBANKER Particularly Dangerous

The use of a PowerShell-based toolkit is intentional. PowerShell is a legitimate, trusted system tool that is frequently allowlisted in enterprise and consumer environments alike. Malicious PowerShell execution is notoriously difficult to detect at the perimeter level, and many endpoint solutions struggle to distinguish malicious from legitimate administrative scripts without behavioral analysis context. Attackers are also likely leveraging obfuscation, living-off-the-land binaries (LOLBins), and possibly encrypted command-and-control channels to minimize detection windows.

Shield53 Recommendations

Immediate Actions for Financial Sector Organizations

  • Enforce PowerShell Constrained Language Mode across all endpoints not requiring administrative PowerShell access — this significantly limits what malicious scripts can execute even if a user is deceived
  • Enable Script Block Logging and PowerShell transcription via Group Policy or your EDR to capture execution chains for forensic and detection purposes
  • Deploy application control policies (e.g., AppLocker, WDAC) to restrict unsigned script execution from user-writable paths
  • Block clipboard-injection-style attacks by monitoring for suspicious Run dialog or PowerShell invocations that originate outside normal administrative workflows
  • Update phishing awareness training to explicitly include ClickFix scenarios — employees need to know that fake CAPTCHA pages asking them to run commands are a red flag, not a routine verification step

Detection Guidance

  • Hunt for PowerShell processes spawned by explorer.exe, mshta.exe, or wscript.exe — these parent-child relationships are strong indicators of ClickFix-style delivery
  • Alert on PowerShell connecting outbound to non-corporate infrastructure shortly after execution
  • Monitor for clipboard content being used as command-line arguments (detectable via process command-line telemetry in EDR tools)

For End Users and Consumers

  • Legitimate websites will never ask you to open a command prompt or PowerShell window and paste commands — if a website asks you to do this, close it immediately
  • Enable multi-factor authentication on all banking, fintech, and cryptocurrency accounts
  • Report suspicious CAPTCHA-style pages to your IT or security team before interacting

REF6045 and SCMBANKER are a clear reminder that the most dangerous attacks are often the simplest. As defenders, our greatest leverage point isn't always the next tool — it's ensuring humans understand what manipulation looks like before they click.