Fake CAPTCHA, Real Commands: The Human Operator Behind a Banking Malware Playbook

The most unsettling part of this case is not the malware name. It is the workflow. A victim lands on a fake verification page, sees a CAPTCHA-like prompt, and is nudged into pasting a command that should never have been trusted in the first place. That small moment of compliance can turn a browser visit into endpoint execution, and, in a banking context, that is enough to matter.

Fast Facts

• REF6045 is a tracking label used for a banking-fraud operation tied to Mexico.
• The chain begins with fake CAPTCHA or ClickFix pages designed to push users into pasting a malicious command.
• A PowerShell toolkit named SCMBANKER is associated with the operation.
• A human operator is described as actively monitoring infected machines.
• The public evidence supports a risk analysis, not a full technical map of victims, scope, or downstream impact.

Why the lure matters more than the payload

ClickFix-style lures work because they abuse a familiar browser pattern: a user expects to prove they are human, complete a check, or clear an error. Instead, the page hands over instructions that move the victim out of the browser and into Windows execution paths such as PowerShell. In practical terms, the attack depends less on a software exploit and more on user-assisted initial access.

That matters for defense. Traditional controls are often tuned to spot malicious attachments or known exploit chains, but a pasted command can look like ordinary troubleshooting if telemetry is thin. PowerShell is a legitimate administration tool, which makes abuse easier to hide in normal enterprise noise. MITRE ATT&CK treats PowerShell as a common interpreter abused for code execution, while Microsoft has documented ClickFix behavior as a technique that manipulates users into running commands through trusted Windows interfaces.

The SCMBANKER label suggests a scripted toolkit rather than a one-off prank. Even without confirmed details about its full feature set, the operational model is clear enough: if a human operator is watching infected hosts, the intrusion can be adapted in real time. That makes the activity more flexible than a fully automated dropper chain, and potentially better suited to banking fraud where timing and context often matter.

At the time of writing, public information has not fully established the technical root cause, the complete scope of affected users, or whether downstream financial systems were compromised. The available information supports a risk analysis, not a definitive claim of broad compromise.

What defenders should watch

For security teams, the warning signs are not just malware files. They are the moments surrounding execution: a suspicious CAPTCHA page, clipboard copying, an immediate jump into PowerShell, and unusual parent-child process trees. Script block logging, PowerShell module logging, application control, and user awareness training all help, but they work best together. A user should never need to open Run, Terminal, or PowerShell to complete a normal verification step.

The broader lesson is simple: modern fraud increasingly begins with trust manipulation, not code execution alone. When a web page becomes a command prompt, the attacker does not need to break in through the front door. They only need the user to hold it open.

WIKICROOK

• ClickFix: A social engineering technique that uses fake verification or error pages to trick users into running commands.
• PowerShell: A built-in Windows scripting environment often abused for malicious execution and staging.
• Script block logging: A PowerShell feature that records script content for detection and forensic review.
• Application control: A policy layer that limits which scripts or binaries are allowed to run.
• Operator-assisted compromise: An intrusion model where a human steers infected machines instead of relying only on automation.