SCMBANKER Malware Hits Mexican Banks via Fake CAPTCHA

Michael Miller · 2026-07-08

A dangerous new banking fraud operation is actively targeting customers of Mexican banks, fintech companies, payment processors, and cryptocurrency exchanges. The attackers are using something called ClickFix lures to trick people into infecting their own systems. Security researchers at Elastic Security Labs have been tracking this activity under the name REF6045. What makes this campaign so sneaky is how it starts. Victims land on fake CAPTCHA verification pages that look totally legitimate. These pages convince users to run a malicious command, which then installs a nasty PowerShell toolkit called SCMBANKER. ### How the Attack Unfolds The whole thing feels like a trap you'd never see coming. Here's the rough sequence: - You visit what seems like a normal website - A fake CAPTCHA challenge appears, asking you to verify you're human - Instead of clicking checkboxes, you're prompted to copy-paste a command into your terminal - That command downloads and runs the SCMBANKER malware Once inside your system, the malware steals banking credentials, intercepts two-factor authentication codes, and can even hijack cryptocurrency transactions. It's designed to be invisible while it does its dirty work. ### Why Mexican Users Are Being Targeted Mexico has seen a huge boom in digital banking and crypto adoption over the past few years. With that growth comes attention from cybercriminals. The attackers behind REF6045 seem to have zeroed in on this market because of the high volume of financial transactions and the relative newness of some fintech platforms. > "These ClickFix lures are particularly dangerous because they rely on social engineering, not technical exploits. The user is tricked into becoming an accomplice in their own infection." ### What Makes ClickFix Lures So Effective? ClickFix attacks work because they bypass traditional security measures. There's no malicious attachment to scan. No suspicious link to block. Instead, the victim willingly executes the attack code themselves, thinking they're just completing a security check. The fake CAPTCHA pages are incredibly well-designed. They mimic the look and feel of real Google or Cloudflare verification screens. Even tech-savvy users might fall for this if they're in a hurry. ### Protecting Yourself from SCMBANKER So what can you do to stay safe? Here are some practical steps: - Never run commands from websites, no matter how legitimate they look - Use a reputable ad blocker to reduce exposure to malicious ads - Keep your browser and operating system updated - Consider using an antidetect browser if you manage multiple accounts or work in crypto - Enable two-factor authentication through authenticator apps, not SMS - Monitor your bank accounts regularly for unusual activity ### The Role of Antidetect Browsers in Security If you're a professional managing multiple accounts or working in digital marketing, an antidetect browser can add a valuable layer of protection. These tools mask your browser fingerprint, making it harder for attackers to track you across sessions. They also let you isolate different activities into separate profiles, so if one gets compromised, the others stay safe. But remember, no tool is a silver bullet. The best defense is a healthy dose of skepticism. If a website asks you to run a command or download something unusual, stop and think. Legitimate sites never ask you to do that. ### What to Do If You Think You've Been Hit If you suspect you've fallen for a ClickFix lure, act fast. Disconnect your device from the internet immediately. Run a full antivirus scan using multiple tools. Change all your passwords from a clean device. Contact your bank and let them know what happened. They can freeze accounts and monitor for fraud. Time is critical here. The faster you respond, the less damage SCMBANKER can do. ### Final Thoughts Cybercriminals are getting more creative every day. The REF6045 campaign shows just how convincing these attacks can be. By understanding how ClickFix lures work and staying vigilant, you can protect yourself and your business from becoming the next victim. Stay safe out there. And remember, if something feels off online, it probably is.