← threat actors
threat actor · not yet in the cluster map
clickfix
also tracked as scmbanker 1, kongtuke 1
2 stories · 2 in the wild · June 30, 2026 – July 9, 2026
evidence: 2 observed
how they got in
- malvertising 1 · Jul 9
- phishing email 1 · Jul 9
sectors
- finance 1 · Jul 9
- technology 1 · Jun 30
malware and tools
- clickfix 1 · Jul 9
- scmbanker 1 · Jul 9
- havoc c2 1 · Jun 30
techniques
- backdoor 1 · Jul 9
- credential theft 1 · Jul 9
- defense evasion 1 · Jun 30
- dll sideloading 1 · Jun 30
- evasion 1 · Jun 30
attack phases seen
- Credential access 2 · Jul 9
- Initial access 1 · Jul 9
- Persistence 1 · Jul 9
- Command and control 1 · Jun 30
- Execution 1 · Jun 30
what we reported, newest first, grouped by story
July 9, 2026
- ClickFix operators expanded: Unit 42 tracks a macOS variant installing a LaunchAgent backdoor via affiliate/cloaking redirects, and Elastic details SCMBANKER (REF6045), an AI-assisted PowerShell toolkit hitting Mexican banking customers via fake CAPTCHA pages. Unit 42, Elastic Security Labs
· Jul 9 · observed · via malvertising · as scmbanker · Threat Activity
June 30, 2026
- Unit 42 detailed a new Kongtuke (ClickFix) campaign sideloading Havoc C2 via a signed WinWrapIDE binary, with an evasive loader using window cloaking, sandbox sleep, and native callback evasion to run a memory-only infostealer. Unit 42
· Jun 30 · observed · as kongtuke · Threat Activity