As cited
Copy frozen at (site build).
threat intel
ClickFix Campaign Generated Via AI Delivers SmartRAT
In March 2026, Zscaler ThreatLabz identified a ClickFix campaign using artificial intelligence (AI)-generated websites to impersonate a Brazilian bank and deliver SmartRAT, a PowerShell-based remote access trojan (RAT). The attack chain combines typosquatting domains with a fake CAPTCHA and Blue Screen of Death (BSOD) overlay to trick users into executing a malicious PowerShell command. SmartRAT supports encrypted command and control (C2) communications, remote desktop access, credential theft via keylogging and banking overlays, fake QR code injection, and persistence mechanisms including scheduled tasks and Windows services targeting Brazil-focused financial institutions.
Why it matters: Organizations and individuals in Brazil using major banking platforms (Banco do Brasil, Bradesco, Itaú, Santander, Caixa, and others) face credential theft and unauthorized fund transfers through fake authentication overlays and QR code swapping; practitioners should monitor for typosquatting domains, block SmartRAT indicators of compromise (IOCs), and educate users to verify domain authenticity before entering credentials or running system commands.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
ClickFix Campaign Generated Via AI Delivers SmartRAT
In March 2026, Zscaler ThreatLabz identified a ClickFix campaign using artificial intelligence (AI)-generated websites to impersonate a Brazilian bank and deliver SmartRAT, a PowerShell-based remote access trojan (RAT). The attack chain combines typosquatting domains with a fake CAPTCHA and Blue Screen of Death (BSOD) overlay to trick users into executing a malicious PowerShell command. SmartRAT supports encrypted command and control (C2) communications, remote desktop access, credential theft via keylogging and banking overlays, fake QR code injection, and persistence mechanisms including scheduled tasks and Windows services targeting Brazil-focused financial institutions.
Why it matters: Organizations and individuals in Brazil using major banking platforms (Banco do Brasil, Bradesco, Itaú, Santander, Caixa, and others) face credential theft and unauthorized fund transfers through fake authentication overlays and QR code swapping; practitioners should monitor for typosquatting domains, block SmartRAT indicators of compromise (IOCs), and educate users to verify domain authenticity before entering credentials or running system commands.
- Source published
- First seen by Cybersecurity Tracker