ClickFix Campaign Uses Fake Google Verification Page to Infect Mexican Bank Customers

A fake Google verification page is being used to infect customers of Mexican banks with a malware toolkit built for fraud, not just espionage.

The campaign relies on a familiar ClickFix trick, where a victim is pushed to copy and run a command that quietly starts the infection chain.

From there, the attackers can watch for banking activity, interfere with sessions, and steer victims toward phone-based scams and phishing pages.

The operation, tracked as REF6045, is notable because it is guided by a human operator who decides when to escalate against each victim.

The malware family, named SCMBANKER, has components that date back to at least October 2025, while Elastic telemetry first surfaced one of the active infections in June 2026.

Its focus is broad inside Mexico’s financial ecosystem, spanning retail banks, business banking portals, fintech services, payment processors, cryptocurrency exchanges, investment platforms, SAT services, and telecom providers.

Researchers at Elastic Security Labs identified the campaign and described it as a ClickFix delivery chain adapted for operator-assisted banking fraud. 

Elastic said in a report shared with Cyber Security News (CSN) that the attackers use fake verification pages to plant the toolkit, then turn infected machines into a live feed for financial abuse.

The result is a campaign that may look crude on the surface but is built to cash out quickly once a target logs in to the right service.

What makes the threat stand out is how much control the operators keep after the initial compromise.

They can capture screenshots, redirect a browser to phishing pages, replace payment details copied to the clipboard, lock the screen behind fake warnings, and even deploy a remote access tool for full hands-on control.

Elastic also found signs that large language models helped write much of the code, lowering the barrier for criminals who want useful features without deep development skill.

ClickFix Campaign Uses Fake Google Verification Page

The infection starts on fake CAPTCHA or verification pages dressed up as a security check, including prompts in Spanish and fake Google security wording.

After the challenge, the page copies a command that pulls a first-stage script and pipes it into the Windows command shell.

That script opens a fake Windows Update screen, pressures the victim for administrator approval, traps the mouse, and then uses bitsadmin to download the rest of the toolkit into the public user directory.

Elastic found several related delivery sites and file servers using the same pattern, which suggests reuse of the same kit across multiple deployments.

The exposed infrastructure also showed poor security on the attacker side, including open directories, a leaked web root archive, and an unauthenticated editor tied to live targeting files.

For defenders, that means suspicious PowerShell activity, bitsadmin downloads, odd use of Windows Run, and scripts launched from unusual directories deserve immediate attention before the fraud stage begins.

User education also matters, because the attack succeeds only when a victim trusts the fake prompt and manually launches it.

Fraud Workflow After Infection

Once SCMBANKER is established, it checks open window titles for bank names and other financial services, then alerts the operator when a useful session appears.

That visibility lets the actor decide whether to trigger screenshots, a phishing redirect, a vishing overlay that pushes the victim to call for help, or clipboard hijacking aimed at account and card data.

In higher-value cases, the toolkit can silently install a commercial remote access tool so the attacker can work directly on the victim machine.

The campaign matters because it combines simple social engineering with real-time decision making, which can turn a single copied command into stolen payments or a full account takeover.

Elastic’s prevention guidance points to monitoring suspicious Run key changes, curl downloads piped into cmd, and DNS lookups tied to suspicious domains, alongside broader detection for script interpreters and remote access abuse.

Even though the malware is messy and full of copy-paste code, the live victim management seen in the operation shows it is already causing real harm.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOC Teams.