[scmbanker]

July 11, 2026

• SCMBANKER targets Mexican banking, fintech, and crypto customers via ClickFix fake-CAPTCHA lures dropping a PowerShell toolkit (tracked by Elastic as REF6045). The Hacker News · Threat Activity & Malware

in Progress Orders ShareFile Storage Controllers Offline Over Active Zero-Day Threat

July 9, 2026

• ClickFix operators expanded: Unit 42 tracks a macOS variant installing a LaunchAgent backdoor via affiliate/cloaking redirects, and Elastic details SCMBANKER (REF6045), an AI-assisted PowerShell toolkit hitting Mexican banking customers via fake CAPTCHA pages. Unit 42, Elastic Security Labs · Threat Activity

in A 15-Year-Old Linux Kernel Bug Hands Root on Every Distro