THREAT OPS › Threat News › ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit
<p>A Mexican banking fraud operation we're tracking as REF6045 doesn't run on autopilot. A human operator is behind the wheel, monitoring infected machines and deciding what happens next. Victims are infected through fake CAPTCHA pages that trick them into running a single command, which installs SCMBANKER, a PowerShell toolkit with components dating back to at least October 2025. Once installed,
MITRE ATT&CK techniques
- Screen CaptureT1113
- IP AddressesT1590.005
- JavaScriptT1059.007
- Boot or Logon Autostart ExecutionT1547
- Hide ArtifactsT1564
- Spearphishing LinkT1566.002
- Spearphishing LinkT1598.003
- Clipboard DataT1115
- System Information DiscoveryT1082
- Application Layer ProtocolT1071
- Remote Access ToolsT1219
- Social EngineeringT1684
- MasqueradingT1036
- Application Window DiscoveryT1010
- Modify RegistryT1112
- System Network Configuration DiscoveryT1016
- Command and Scripting InterpreterT1059
- Web ServiceT1102
- Financial TheftT1657
- User ExecutionT1204
- Exfiltration Over C2 ChannelT1041
- PowerShellT1059.001
- Registry Run Keys / Startup FolderT1547.001
- PhishingT1566
- Input CaptureT1056
- CredentialsT1589.001
- BITS JobsT1197
- Hidden WindowT1564.003
- Windows Command ShellT1059.003
- Web ProtocolsT1071.001
- Ingress Tool TransferT1105
- Hidden Files and DirectoriesT1564.001
- Malicious LinkT1204.001
- System Shutdown/RebootT1529
- Malicious LinkAML.T0011.003
- Command and Scripting InterpreterAML.T0050
- MasqueradingAML.T0074
Indicators of compromise
- b30cb0aa977aacdab94d2ef503186c8f0b2fc10d7cf0d7c7c0ada70c127dc7e8sha256
- 554f1aefeb698995501751328c2f9fe93f02a680679fba3dd15f1ed93d46bf1bsha256
- ff3555154e91e42490cc722b6c7f3c4c91654b7ef53a35d0719ffb89accf1b27sha256
- 526287a40aad1b218228cdd1f459ad3b93f858585048347644d597c6ab19515asha256
- 685d29ce8a550feb3a9e1d1c5926ec5e927615cf34aab62c108a812a1eb6737csha256
- 8c87ea94401fa97d3743a87604e088d1a29c7b06cf9673623941a42da68452a6sha256
- 6dcd7fdd5e088d98d861cbd1cb74a7b83ae5508f4dbb617413bcbe7fbc8a82e2sha256
- 4d9c160ebb44507b11f0e6421f691900284f25b5530a23d9fd50de0ae01663casha256
- 0315d4a7bc14654ad66d4c2b98920b92ca18cbc231b3ce5fba1fcac70b828e19sha256
- 5d17645548a44fe39d3cc816ffa3933321c1eb8b08a8f4348e3cd82f25112c81sha256
- 566f4bfdfea54129b8528d50cae187a9030e2f2787749add4b0db22ac35ea581sha256
- 882d582e85d5bb7abbdde791a2d52e3b1bb7dd7f79c20318ce64b74249221fdbsha256
- eea08fbf3720d638af1d313d3ce369708b77d7891379d5c5871dd7f36667ed0csha256
- 70140aa236d630a7d5ed08be3dafcccea9a8b0eec6dadf8c1cf1b96d8f608609sha256
- 6c8ba7127a83431432e85946976c18bb3f3e9bf9def68aae572cd1d9d73604c7sha256
- 81a4512db985359ed361755da58a1177b07632b5aee951c68a6ace54f4d0534bsha256
- 3d9015429d65276869ceb9c91f10d6474b1098042db75949c49b9f1682c1f3aesha256
- 5bc85b604eb37ffa1e67c57f4744b55ef876a1ab442e2a2440550ef0922aeec7sha256
- 30ff24faad80184bb43660a8bd317df99a8d09d31bae3b446aaa876543f2620fsha256
- 4b7b35b921d7615b7a82a42c379560d1b0c5a74c81311a269874195ba2744f2dsha256
- 5c7ab9e90b05804d07e9d803f85462bc1a44d0726256bad28219984ee2b5772fsha256
- 32d981b3e7c36aa7030cfd9ee412bff742e00b36c39c80634b2681f89de4a487sha256
- cd7b179dd98848a02b9a1d4ebfeee26cdbb317b4ad53eb50786e18515b0cf804sha256
- 345e8a90b7b762b065333cd068811d88086d157be713d89bdf200c927645f3d8sha256
- 0ec9b518f84b6bdc0e843b89fa755522ec67db862414ad16bdcaa8c2be25485csha256
- 26f906a2a4276b1968a8ce956a7b342aa9bc26f60d32c14668223877f569fb3fsha256
- 13bfd0f695cea1d6ae570a7ca056ffe930467be73a26f29f95209618f383bd2dsha256
- cfbeb1b194b2e186fc599eb51d4719ccmd5
- 5851f64467bac4c456dab67e2fb55622md5
- http://68.211.161.46/files/url
- http://68.211.161.46/url
- https://ww.ssinvestigaciones.com/login3.phpurl
- https://developer.mozilla.org/en-US/docs/Web/API/Clipboard/writeTexturl
- https://ratonvaquero2026.online/url
- http://68.211.161.46/validation.txturl
- https://ratonvaquero2026.online/files/url
- https://negratomasa2026.online/dashboard2/recData.phpurl
- https://monteviral2026.duckdns.org/url
- https://monteviral2026.duckdns.org/files/url
- https://gestionmontelavaria2026.online/dashboard2/recData.phpurl