A sophisticated, operator-assisted banking fraud campaign, dubbed REF6045, targets Mexico's financial sector using a PowerShell toolkit named SCMBANKER. Victims are initially compromised through fake CAPTCHA pages that trick them into executing a single command, installing the toolkit. Unlike automated attacks, REF6045 relies on human operators who monitor infected machines, making real-time decisions on next steps, ranging from locking screens during banking sessions to initiating vishing calls or deploying commercial remote-access tools for full system takeovers.
SCMBANKER offers a comprehensive fraud workflow, including banking-session monitoring, screenshot capture, vishing overlays, phishing redirects, and manipulation of copied account numbers. The toolkit utilizes various persistence mechanisms and evasive techniques, often leveraging legitimate Windows functionalities. Notably, researchers observed strong indicators of AI assistance in the development of SCMBANKER's scripts, showcasing a growing trend in malware creation where large language models are heavily utilized to generate functional code, albeit with manual obfuscation applied afterward.
Despite its crude execution and significant OPSEC failures—such as exposed directories and an unauthenticated file editor that revealed the operation's inner workings—REF6045 remains effective, actively impacting victims. The insights gained from these failures underscore the importance of robust security practices and the evolving landscape of cyber threats, where even less sophisticated operations can achieve their goals through adaptive tactics and AI-powered development.
Top comments (0)