ClickFix Campaign Generated Via AI Delivers SmartRAT
Essential information
- Published
- 17/06/2026 20:20
- Modified
- 17/06/2026 20:25
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- ai-generated banana rat banking trojan brazil clickfix credential theft fake captcha ghostloader powershell qr code interception remcos rat smartrat typosquatting
- Tags
- 2026-06-17 ai-generated banana rat banking trojan brazil clickfix credential-theft fake captcha ghostloader powershell qr code interception remcos rat smartrat typosquatting
- Related entities
- 9 indicators, 9 observables, 20 techniques (mitre), 4 malware, 8 others
Description
In March 2026, threat actors leveraged AI-powered website builders to create typosquatting domains impersonating a Brazilian bank. The campaign employed ClickFix techniques, presenting victims with fake CAPTCHA and BSOD screens to trick them into executing malicious PowerShell commands. This delivered SmartRAT, a PowerShell-based banking trojan with capabilities including encrypted C2 communications, remote control of screen/keyboard/mouse, credential theft through keylogging and banking overlays, and QR code interception for transaction fraud. The malware establishes persistence via scheduled tasks and Windows services, and targets Brazilian financial institutions, payment platforms, and cryptocurrency exchanges. The threat actors' C2 panel contained critical authentication flaws allowing client-side bypass, suggesting deployment without adequate security review.